CVE-2026-84744: WPForms Lite Shortcode Injection Vulnerability

CVE-2026-84744 Overview

CVE-2026-84744 affects the WPForms Lite WordPress plugin from version 1.5.0.1 through 2.0.2. The plugin fails to strip shortcode delimiters from submitted field values before rendering them back into the form. Unauthenticated attackers can submit crafted field values that contain WordPress shortcodes. When the server processes the form response, it executes those shortcodes in the site context. This behavior allows attackers to invoke any shortcode registered on the target site and to retrieve attachment metadata associated with non-public posts. The vulnerability is tracked under [CWE-94] Improper Control of Generation of Code.

Critical Impact

Unauthenticated attackers can execute arbitrary registered shortcodes and disclose attachment details from non-public posts through crafted form submissions.

Affected Products

• WPForms Lite plugin for WordPress, version 1.5.0.1
• WPForms Lite plugin for WordPress, versions through 2.0.2
• WordPress sites that render user-submitted field values back to the browser

Discovery Timeline

• 2026-09-28 - CVE-2026-84744 published to the National Vulnerability Database
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-84744

Vulnerability Analysis

WPForms Lite accepts user input through standard form fields and echoes those values back in the rendered confirmation output. The plugin does not sanitize shortcode delimiters such as the opening and closing square brackets. WordPress parses any text containing valid shortcode syntax and executes the matching shortcode handler. Because the input traverses an unauthenticated submission path, no account or session is required to trigger the behavior.

An attacker can invoke any shortcode the site exposes, including shortcodes added by other installed plugins or themes. Shortcodes that query post or attachment data return information the attacker would otherwise not be able to read. The advisory specifically notes exposure of attachment details tied to non-public posts, which breaks the confidentiality boundary WordPress enforces on draft and private content.

Root Cause

The root cause is missing input neutralization before output rendering. The plugin treats submitted field values as safe strings and passes them through the WordPress shortcode processor. [CWE-94] describes this class of defect, where downstream code executes attacker-controlled syntax instead of treating it as inert data.

Attack Vector

Exploitation requires network access to a WordPress site running a vulnerable WPForms Lite installation. The attacker submits a form containing shortcode syntax inside a field value. The plugin processes the submission, rebuilds the form response, and the WordPress shortcode engine executes the embedded directives. No authentication, user interaction beyond submission, or elevated privileges are needed. For technical specifics, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-84744

Indicators of Compromise

• Form submission payloads that contain [ and ] delimiters wrapping known shortcode names such as [gallery], [embed], or plugin-specific tags.
• Unexpected database queries for attachment metadata originating from the WPForms submission handler.
• Rendered form confirmation pages that include content pulled from private or draft posts.

Detection Strategies

• Inspect HTTP POST bodies to WPForms endpoints for shortcode syntax inside form field parameters.
• Correlate form submission events with calls to the WordPress do_shortcode() function in debug or application logs.
• Review web server access logs for repeated form submissions from the same source address that contain bracketed payloads.

Monitoring Recommendations

• Enable WordPress debug logging to capture shortcode processor activity during form rendering.
• Alert when unauthenticated POST requests to form endpoints include characters associated with shortcode syntax.
• Track outbound responses from form confirmation pages for content tied to attachment IDs that belong to non-public posts.

How to Mitigate CVE-2026-84744

Immediate Actions Required

• Update WPForms Lite to a release later than 2.0.2 that strips shortcode delimiters from submitted field values.
• Audit installed shortcodes and disable any that expose sensitive post, user, or attachment data.
• Restrict form submission endpoints behind a web application firewall rule that rejects shortcode syntax in field values.

Patch Information

Refer to the WPScan Vulnerability Report for the fixed version and vendor remediation details. Apply the vendor-supplied update through the WordPress plugin updater or by replacing the plugin directory with the patched release.

Workarounds

• Deploy a WAF signature that blocks POST parameters containing [shortcode] patterns targeted at WPForms endpoints.
• Temporarily disable WPForms Lite on affected sites until the patched version is installed.
• Remove or restrict high-risk shortcodes that query non-public content, limiting the blast radius if the flaw is triggered.

# Example WAF rule concept to block shortcode syntax in WPForms submissions
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026084744,msg:'WPForms shortcode injection attempt'"
  SecRule ARGS "@rx \[[a-z0-9_\-]+(\s|\])" "t:none,t:lowercase"