WPMU DEV Forminator Forms Plugin up to 1.58.1 on WordPress Shortcode Execution forminator_replace_quiz_form_data referer_url injection

Summaryinfo

A vulnerability classified as critical was found in WPMU DEV Forminator Forms Plugin up to 1.58.1. Affected by this issue is the function forminator_replace_quiz_form_data of the component Shortcode Execution. The manipulation of the argument referer_url results in injection. This vulnerability is reported as CVE-2026-101335. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in WPMU DEV Forminator Forms Plugin up to 1.58.1. Affected is the function forminator_replace_quiz_form_data of the component Shortcode Execution. The manipulation of the argument referer_url with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.

The advisory is shared for download at wordfence.com. This vulnerability is traded as CVE-2026-101335 since 09/28/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/16/2026). The MITRE ATT&CK project declares the attack technique as T1055.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• WPMU DEV

Name

• Forminator Forms Plugin

Version

• 1.58.0
• 1.58.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion