CVE-2026-103911: Forminator WordPress Plugin RCE Vulnerability

CVE-2026-103911 Overview

CVE-2026-103911 affects the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress through version 1.58.1. The plugin invokes do_shortcode on user-controlled input without proper validation, allowing unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires no Forminator-specific content or configuration on the target site. Attackers can trigger execution through a single unauthenticated GET request to the search results page on any block-theme install, or by submitting an anonymous comment on any post with comments enabled. The flaw is classified as improper control of code generation [CWE-94].

Critical Impact

Unauthenticated attackers can execute arbitrary WordPress shortcodes on vulnerable sites, enabling information disclosure and tampering with rendered page content without any user interaction.

Affected Products

• Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
• All plugin versions up to and including 1.58.1
• WordPress sites running block themes or with comments enabled on any post

Discovery Timeline

• 2026-10-16 - CVE-2026-103911 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-103911

Vulnerability Analysis

The vulnerability resides in the Forminator plugin's core class, specifically in logic that passes user-supplied values to WordPress's do_shortcode function without sanitization or context validation. The plugin registers handlers that execute during two common request paths: block-theme search results rendering and anonymous comment submission. Both paths accept attacker-controlled input and forward it to the shortcode parser.

Because WordPress shortcodes can invoke arbitrary registered callbacks, an attacker can leverage any shortcode exposed by WordPress core, the active theme, or any installed plugin. The impact depends on which shortcodes exist on the target site, but commonly includes rendering privileged content, exposing internal data, or embedding attacker-controlled markup.

Root Cause

The root cause is improper neutralization of input before passing it to a code-interpretation function [CWE-94]. The affected code at library/class-core.php lines 167 and 290 in version 1.57.3 calls do_shortcode on values derived from HTTP request parameters. The plugin assumes these values are safe, but no allowlist or stripping of shortcode syntax occurs before execution.

Attack Vector

Exploitation requires no authentication, no user interaction, and no prior configuration of Forminator forms on the target. An attacker sends either an unauthenticated GET request to the WordPress search endpoint on a block-theme site, or submits an anonymous comment to any post that permits comments. The injected shortcode is parsed and executed server-side during response rendering. The attack originates over the network against any reachable WordPress install with the vulnerable plugin active.

Technical details on the vulnerable call sites are available in the WordPress Forminator Core Class source at line 167 and line 290.

Detection Methods for CVE-2026-103911

Indicators of Compromise

• HTTP GET requests to /?s= or search endpoints containing bracketed shortcode syntax such as [ and ] in the query string
• Anonymous POST requests to wp-comments-post.php containing shortcode markup in the comment body field
• Unexpected rendering of plugin or theme shortcodes within search result pages or comment threads
• Web server access logs showing unauthenticated requests with URL-encoded shortcode payloads targeting pages that do not normally include forms

Detection Strategies

• Inspect WordPress access logs for request parameters containing %5B and %5D (URL-encoded brackets) paired with known shortcode names
• Deploy web application firewall rules that flag shortcode syntax appearing in untrusted request fields such as s, comment, and author
• Correlate anomalous comment submissions with subsequent outbound requests or privileged shortcode output in rendered responses

Monitoring Recommendations

• Enable verbose logging on the WordPress comment and search subsystems and forward events to a centralized analytics platform
• Monitor the installed version of the Forminator plugin across the WordPress estate and alert on versions at or below 1.58.1
• Track the Wordfence Vulnerability Report for additional detection signatures and exploitation telemetry

How to Mitigate CVE-2026-103911

Immediate Actions Required

• Upgrade the Forminator plugin to the patched release that supersedes version 1.58.1 on every WordPress site in the environment
• Audit all WordPress installs for the Forminator plugin presence and inventory affected versions
• Review access logs for the past 30 days for shortcode syntax in search queries and comment submissions
• Temporarily disable the Forminator plugin on sites that cannot be patched immediately

Patch Information

The vendor addressed the issue in a subsequent plugin release. The fix is tracked in WordPress Forminator Changeset 3745883, which modifies the vulnerable do_shortcode call paths in library/class-core.php. Administrators should apply the update through the WordPress plugin manager or by deploying the patched plugin package.

Workarounds

• Disable anonymous comments on all posts until the patched plugin version is deployed
• Switch away from block themes temporarily if the search results code path cannot be otherwise restricted
• Deploy web application firewall rules that strip or block bracketed shortcode syntax in s, comment, and related request parameters
• Deactivate the Forminator plugin on affected sites until the update is applied

# Configuration example
# WP-CLI commands to inventory and update the Forminator plugin
wp plugin list --name=forminator --fields=name,status,version
wp plugin update forminator
# Temporarily disable comments site-wide while patching
wp option update default_comment_status closed