Live › vulnerability › CVE-2026-103911
Go to dashboardThe Forminator Forms WordPress plugin up to and including 1.58.1 passes an unvalidated value to do_shortcode, so anyone can run arbitrary WordPress shortcodes. An attacker can trigger this with one unauthenticated GET request to the search results page or by posting an anonymous comment where comments are enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Forminator Forms plugin at version 1.58.1 or older are affected, and the description says exploitation works on any block-theme install with no Forminator-specific content or configuration needed. Sites without Forminator installed, or running a patched version, can skip it.
No product ranges from the sources yet.
wp plugin get forminator --field=version1.58.1; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-103911")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.