Cyber & AI intelligence
Wasteland.
Briefs indexed2769
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-92229 2026-09-19

CVE-2026-92229: Unauthenticated Shortcode Execution in Forminator Forms for WordPress

"A critical flaw (CVSS 9.1) in the Forminator Forms WordPress plugin lets unauthenticated attackers execute arbitrary shortcodes on affected sites."

A critical flaw (CVSS 9.1) in the Forminator Forms WordPress plugin lets unauthenticated attackers execute arbitrary shortcodes on affected sites.

What Is It

CVE-2026-92229 is an arbitrary shortcode execution vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress, published by Wordfence on 2026-09-19. The plugin allows users to trigger an action that passes a value to do_shortcode without properly validating it first. Because that path is reachable without authentication, any remote attacker can supply shortcode input and have WordPress render it.

The issue is classified as CWE-94 (Improper Control of Generation of Code). It carries a CVSS 3.1 base score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, network attack vector, low complexity, no privileges, and no user interaction, with high confidentiality and integrity impact.

Why It Matters

The combination of no authentication, no user interaction, and low attack complexity means exploitation requires nothing more than network access to the target site. The impact metrics rate both confidentiality and integrity as HIGH: rendering an attacker-chosen shortcode can surface data the visitor was never meant to see and alter what the site outputs. Because the vulnerable code sits in the plugin's front-end request handling, sites running an affected release should be assumed to expose that path to unauthenticated network traffic; though whether it is actually reachable on a given site likely depends on which Forminator modules and front-end actions are in use there.

Wordfence's advisory references specific code locations in the plugin's quiz front-end action handlers and the shared front-action abstract class, indicating the unvalidated value reaches do_shortcode through the quiz module's request handling.

What's Vulnerable

Patch Status

The NVD record is in Received status and lists no CISA KEV entry, so there is no confirmation of active exploitation and no federally mandated remediation deadline at this time. Wordfence's references include a WordPress plugin repository changeset (3700724@forminator) associated with the fix. Administrators should verify they are running a release newer than 1.57.2 and update from the plugin repository.

Sources