CVE-2026-103911 in Forminator Forms Plugin
Summary
by MITRE • 10/16/2026
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in The Forminator Forms plugin for WordPress represents a critical security flaw affecting all versions up to and including 1.58.1. This issue stems from an improper validation of user-supplied input prior to its processing by the do_shortcode function, which is responsible for parsing and executing shortcodes within post content or widget areas. The core technical failure lies in the application's inability to distinguish between legitimate shortcode syntax and maliciously crafted strings that mimic such syntax but contain executable code intended to perform unauthorized actions. Because the validation logic is insufficient, any string formatted as a shortcode can be interpreted by WordPress as valid command input, leading to arbitrary code execution within the context of the web server.
From an operational perspective, this vulnerability allows unauthenticated attackers to exploit the flaw without requiring prior authentication or specific configuration of the Forminator plugin itself. The attack surface is broad because exploitation does not depend on the presence of actual form elements created by the plugin. Instead, it can be triggered through two primary vectors available in standard WordPress installations using block themes. First, an attacker can send a single unauthenticated GET request to the search results page, injecting malicious shortcode payloads into query parameters that are subsequently processed during the rendering of search outcomes. Second, attackers can submit anonymous comments on any post where comments are enabled; if the comment content includes crafted shortcodes, these will be executed when the comment is displayed or processed by the theme's template files. This means that even sites not actively using Forminator for forms remain vulnerable if they use a block theme and have public commenting capabilities enabled.
The impact of this vulnerability extends beyond simple information disclosure. Arbitrary shortcode execution can lead to remote code execution, data exfiltration, defacement, or further lateral movement within the network infrastructure hosting the WordPress instance. Attackers may leverage known shortcodes from other plugins or core WordPress features to perform actions such as retrieving user lists, modifying site options, or executing system commands if specific dangerous functions are exposed through shortcode implementations. The lack of authentication requirement significantly lowers the barrier for entry, enabling automated scanning tools and opportunistic attackers to compromise vulnerable sites at scale across the internet.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where user input is directly passed to a code generation or execution function without adequate sanitization or validation. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving web application exploitation and potentially command injection depending on how the executed shortcodes interact with underlying PHP functions. The attack vector falls under Initial Access via Web Application Exploits, leveraging unauthenticated access to gain a foothold in the target environment.
Mitigation strategies must focus on immediate remediation through software updates and defensive configuration changes. Administrators should upgrade The Forminator Forms plugin to version 1.58.2 or later, where this validation flaw has been addressed by implementing stricter input sanitization before shortcode processing occurs. For sites that cannot immediately update due to compatibility concerns, temporary mitigations include disabling comments on public-facing posts if they are not essential for business operations, thereby removing one of the primary exploitation vectors. Additionally, deploying a Web Application Firewall (WAF) with rules specifically designed to detect and block malicious shortcode patterns in GET parameters and comment submissions can provide an effective layer of defense against automated attacks. Regular security audits and monitoring for unusual activity related to shortcode execution should also be implemented to ensure early detection of any attempted exploitation attempts.