CVE-2026-103911
Received Received - Intake

Arbitrary Shortcode Execution in Forminator WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-103911
EUVD
EUVD-2026-102646

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Forminator Forms WordPress plugin up to version 1.58.1. It allows unauthenticated attackers to execute arbitrary shortcodes by exploiting improper input validation in an action function. The flaw can be triggered via a GET request to the search results page or by submitting an anonymous comment on any post with comments enabled.

Detection Guidance

Check WordPress sites for the Forminator plugin versions up to 1.58.1. Look for unauthorized shortcode execution attempts in server logs, especially on search results pages or comment submissions. Monitor for unexpected shortcode outputs in web pages or responses.

Impact Analysis

An attacker could exploit this to run malicious shortcodes, potentially leading to unauthorized actions, data theft, or further compromise of the WordPress site. Since no authentication is required, any unpatched site using the vulnerable plugin is at risk.

Mitigation Strategies

Update the Forminator plugin to the latest version immediately. If an update is unavailable, disable the plugin temporarily. Review server logs for signs of exploitation and remove any unauthorized shortcodes or malicious content found.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart