{"id":"CVE-2026-101335","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-101335","generatedAt":"2026-10-28T01:46:17.710Z","title":"The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1.","description":"The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.","published":"2026-10-16T05:17:28.000Z","lastModified":"2026-10-16T15:16:59.000Z","status":"Deferred","sourceIdentifier":"security@wordfence.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-94"],"affected":[],"epss":{"score":0.0028,"percentile":0.20295,"date":"2026-10-26","history":[{"date":"2026-10-16","score":0.0028,"percentile":0.19142}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-16T05:17:28.000Z","detail":{"score":"6.5","severity":"MEDIUM","publishedAt":"2026-10-16T05:17:27.933Z"},"summary":"New CVE, medium severity (CVSS 6.5)."}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1476","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1652","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L2965","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/quizzes/front/front-mail.php#L36","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=cve","source":"security@wordfence.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-101335","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}