---
id: "CVE-2026-103911"
kind: "vulnerability"
aliases: ["CVE-2026-103911"]
title: "WordPress Forminator plugin: unauthenticated shortcode execution through search and comments"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["block-theme", "forminator", "package", "self-hosted", "wordpress"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-16T05:17:28+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:59:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103911", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# WordPress Forminator plugin: unauthenticated shortcode execution through search and comments

The Forminator Forms WordPress plugin up to and including 1.58.1 passes an unvalidated value to do_shortcode, so anyone can run arbitrary WordPress shortcodes. An attacker can trigger this with one unauthenticated GET request to the search results page or by posting an anonymous comment where comments are enabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Forminator version in the WordPress admin plugins list or with `wp plugin get forminator --field=version`
- Confirm whether the site uses a block theme, which the description says makes exploitation easier
- Unknown whether a simple request test to the search page reveals the flaw without exploiting it

## Fix

- Update Forminator to a version newer than `1.58.1`; the exact fixed version is unknown from the sources
- Until patched, unknown whether disabling anonymous comments or restricting search is a sufficient workaround

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103911

## From the sources

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_