---
id: "CVE-2026-101335"
kind: "vulnerability"
aliases: ["CVE-2026-101335"]
title: "Forminator WordPress plugin: unauthenticated shortcode execution through quiz notifications"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["forminator", "package", "wordpress", "wordpress-plugins"]
not_affected_if: ["forminator-above-1.58.1", "no-quiz-forms", "no-quiz-result-merge-tag"]
published_at: "2026-10-16T05:17:27+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:59:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101335", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Forminator WordPress plugin: unauthenticated shortcode execution through quiz notifications

Forminator Forms for WordPress, up to and including 1.58.1, runs attacker-supplied text from the User-Agent header and a referer POST parameter through WordPress shortcode processing on quiz notifications. An unauthenticated visitor can execute whatever shortcodes other installed plugins or themes register, which can mean content injection or information disclosure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Forminator version in the WordPress admin plugin list or with `wp plugin get forminator --field=version`
- Look for quiz forms whose notification body contains `{quiz_result}`

## Fix

- Update Forminator Forms to a version later than `1.58.1`; the exact fixed version is unknown from the sources
- Remove `{quiz_result}` from quiz notification templates until updated

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101335

## From the sources

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_