{"id":"CVE-2026-101335","kind":"vulnerability","aliases":["CVE-2026-101335"],"related":[],"title":"Forminator WordPress plugin: unauthenticated shortcode execution through quiz notifications","description":"The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.","summary":"Forminator Forms for WordPress, up to and including 1.58.1, runs attacker-supplied text from the User-Agent header and a referer POST parameter through WordPress shortcode processing on quiz notifications. An unauthenticated visitor can execute whatever shortcodes other installed plugins or themes register, which can mean content injection or information disclosure.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forminator","package","wordpress","wordpress-plugins"],"not_affected_if":["forminator-above-1.58.1","no-quiz-forms","no-quiz-result-merge-tag"],"how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list or with `wp plugin get forminator --field=version`\n- Look for quiz forms whose notification body contains `{quiz_result}`","fix":"- Update Forminator Forms to a version later than `1.58.1`; the exact fixed version is unknown from the sources\n- Remove `{quiz_result}` from quiz notification templates until updated","status":"open","published_at":"2026-10-16T05:17:27+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:59:13+00:00","updated_at":"2026-10-25T03:59:13+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:59:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update Forminator Forms to a version later than `1.58.1`; the exact fixed version is unknown from the sources\n- Remove `{quiz_result}` from quiz notification templates until updated","reach":"internet","title":"Forminator WordPress plugin: unauthenticated shortcode execution through quiz notifications","impact":"medium","summary":"Forminator Forms for WordPress, up to and including 1.58.1, runs attacker-supplied text from the User-Agent header and a referer POST parameter through WordPress shortcode processing on quiz notifications. An unauthenticated visitor can execute whatever shortcodes other installed plugins or themes register, which can mean content injection or information disclosure.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","forminator"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated visitors trigger site shortcodes, leaking or injecting content","analyst_note":"","how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list or with `wp plugin get forminator --field=version`\n- Look for quiz forms whose notification body contains `{quiz_result}`","needs_analyst":false,"not_affected_if":["forminator-above-1.58.1","no-quiz-forms","no-quiz-result-merge-tag"],"who_is_affected":"Sites running the Forminator Forms plugin at version 1.58.1 or earlier that have quiz forms with notification templates containing the {quiz_result} merge tag. The impact depends on which shortcodes other plugins and themes on the same site register, so sites with few shortcodes face less risk. Sites without Forminator, or running a later version, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":3572,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101335':12A,15A '-2026':11A,14A '/esc_html':163C '1.58.1':30B,100C 'agent':40B,136C,151C 'arbitrari':91C,181C,214C 'attack':33B,145C,178C 'attacker-control':144C 'attacker-suppli':32B 'bodi':120C 'builder':84C 'byte':147C 'carri':142C 'contact':78C 'contain':195C 'content':70B,215C 'control':146C 'custom':82C 'cve':10A,13A 'data':110C 'delimit':171C 'depend':201C 'disclosur':74B,219C 'due':103C 'earlier':133C 'earlier-substitut':132C 'execut':6A,58B,93C,180C 'expand':118C 'expos':205C 'field':162C 'form':23B,77C,79C,81C,83C,109C 'formin':1A,16B,22B,76C,106C 'fulli':117C 'header':41B,152C 'helper':111C 'impact':200C 'includ':29B,99C 'inform':73B,218C 'inject':71B,216C 'instal':62B,208C 'invok':112C 'make':173C 'mean':69B 'merg':125C,140C 'neither':164C 'notif':9A,53B,119C,193C 'packag':17B 'paramet':46B,158C 'payment':80C 'plugin':3A,21B,63B,85C 'plugins/themes':209C 'possibl':175C 'post':45B,157C 'process':50B 'quiz':8A,52B,108C,123C,191C,196C 'rang':212C 'refer':44B,138C,155C 'regist':66B,184C 'replac':107C 'result':124C,197C,199C 'run':31B 'sanit':160C 'shortcod':5A,49B,60B,92C,114C,170C,183C,204C 'site':187C 'strip':167C 'submit':189C 'substitut':129C,134C 'suppli':34B 'tag':126C,141C 'templat':194C 'text':35B,161C 'theme':65B 'unauthent':4A,55B,143C,177C 'url':139C,156C 'user':39B,135C,150C 'user-ag':38B,149C 'version':95C 'visitor':56B 'vulner':89C 'whatev':59B 'whose':192C 'wordpress':2A,18B,20B,25B,48B,87C,182C 'wordpress-plugin':19B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Forminator Forms plugin at version 1.58.1 or earlier that have quiz forms with notification templates containing the {quiz_result} merge tag. The impact depends on which shortcodes other plugins and themes on the same site register, so sites with few shortcodes face less risk. Sites without Forminator, or running a later version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101335","severity":null,"published_at":"2026-10-16T05:17:27+00:00","modified_at":"2026-10-16T15:16:58+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}