{"id":"CVE-2026-103911","kind":"vulnerability","aliases":["CVE-2026-103911"],"related":[],"title":"WordPress Forminator plugin: unauthenticated shortcode execution through search and comments","description":"The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.","summary":"The Forminator Forms WordPress plugin up to and including 1.58.1 passes an unvalidated value to do_shortcode, so anyone can run arbitrary WordPress shortcodes. An attacker can trigger this with one unauthenticated GET request to the search results page or by posting an anonymous comment where comments are enabled.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["block-theme","forminator","package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Forminator version in the WordPress admin plugins list or with `wp plugin get forminator --field=version`\n- Confirm whether the site uses a block theme, which the description says makes exploitation easier\n- Unknown whether a simple request test to the search page reveals the flaw without exploiting it","fix":"- Update Forminator to a version newer than `1.58.1`; the exact fixed version is unknown from the sources\n- Until patched, unknown whether disabling anonymous comments or restricting search is a sufficient workaround","status":"open","published_at":"2026-10-16T05:17:28+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:59:13+00:00","updated_at":"2026-10-25T03:59:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:59:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update Forminator to a version newer than `1.58.1`; the exact fixed version is unknown from the sources\n- Until patched, unknown whether disabling anonymous comments or restricting search is a sufficient workaround","reach":"internet","title":"WordPress Forminator plugin: unauthenticated shortcode execution through search and comments","impact":"high","summary":"The Forminator Forms WordPress plugin up to and including 1.58.1 passes an unvalidated value to do_shortcode, so anyone can run arbitrary WordPress shortcodes. An attacker can trigger this with one unauthenticated GET request to the search results page or by posting an anonymous comment where comments are enabled.","category":"package","nicknames":[],"who_cares":["wordpress","forminator","block-theme","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary WordPress shortcodes on the server without logging in","analyst_note":"Confirm the fixed Forminator version and the vendor advisory; the sources give no patched release number.","how_to_check":"- Check the installed Forminator version in the WordPress admin plugins list or with `wp plugin get forminator --field=version`\n- Confirm whether the site uses a block theme, which the description says makes exploitation easier\n- Unknown whether a simple request test to the search page reveals the flaw without exploiting it","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Forminator Forms plugin at version 1.58.1 or older are affected, and the description says exploitation works on any block-theme install with no Forminator-specific content or configuration needed. Sites without Forminator installed, or running a patched version, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":3437,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103911':13A,16A '-2026':12A,15A '1.58.1':35B,102C 'action':114C 'allow':109C 'anonym':69B,161C 'anyon':44B 'arbitrari':47B,92C,135C 'attack':51B,132C 'block':18B,143C 'block-them':17B,142C 'builder':85C 'comment':10A,70B,72B,162C,167C 'configur':175C 'contact':79C 'content':173C 'custom':83C 'cve':11A,14A 'due':105C 'enabl':74B,168C 'execut':6A,94C,112C,134C,180C 'exploit':139C 'form':28B,78C,80C,82C,84C 'formin':2A,20B,27B,77C,171C 'forminator-specif':170C 'get':58B,150C 'host':24B 'includ':34B,101C 'instal':145C 'make':127C 'one':56B 'packag':21B 'page':64B,156C 'pass':36B 'payment':81C 'plugin':3A,30B,86C 'possibl':129C 'post':67B,165C 'proper':118C 'request':59B,151C 'requir':177C 'result':63B,155C 'run':46B,123C 'search':8A,62B,154C 'self':23B 'self-host':22B 'shortcod':5A,42B,49B,93C,125C,136C 'singl':148C 'softwar':108C 'specif':172C 'submit':159C 'theme':19B,144C 'trigger':53B,179C 'unauthent':4A,57B,131C,149C 'unvalid':38B 'user':110C 'valid':119C 'valu':39B,121C 'version':97C 'via':146C 'vulner':90C 'wordpress':1A,25B,29B,48B,88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Forminator Forms plugin at version 1.58.1 or older are affected, and the description says exploitation works on any block-theme install with no Forminator-specific content or configuration needed. Sites without Forminator installed, or running a patched version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103911","severity":null,"published_at":"2026-10-16T05:17:28+00:00","modified_at":"2026-10-16T15:17:02+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}