# Cool FormKit Lite <= 2.7.10 - Unauthenticated Arbitrary Shortcode Execution via Form Field Values

- **ID:** WPSEC-2026-2580
- **Plugin:** Cool FormKit Lite – Advanced Form Builder for Elementor (`extensions-for-elementor-form`), https://wordpress.org/plugins/extensions-for-elementor-form/
- **Affected versions:** from 2.4.0 before 2.7.11
- **Fixed in:** 2.7.11 (Update to 2.7.11 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/extensions-for-elementor-form
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2580/

## Description

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via submitted form field values in all versions up to, and including, 2.7.10. This is due to the Email action substituting user-submitted values for [field id="..."] placeholders in the email content template before passing the result to do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting shortcode syntax in a field that the form's Email action content references.

## References

- https://wpsec.com/vuln/WPSEC-2026-2580/
- https://plugins.svn.wordpress.org/extensions-for-elementor-form/tags/2.7.11/
- https://wordpress.org/plugins/extensions-for-elementor-form/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2580/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.