CVE-2026-103911

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.

• CWE-94

• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L167
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/class-core.php#L290
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9d922a8f-611f-4586-b8ba-72d18d11a975?source=cve

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103903An incorrect authorization vulnerability in the WinBox authe…8.8
• CVE-2026-103904The public consent endpoint of JTL-Shop accepts arbitrary co…9.3
• CVE-2026-103905The authentication middleware of the JTL-Shop administration…7.5
• CVE-2026-103907The JNews - Jeg Elementor Kit plugin for WordPress is vulner…6.5
• CVE-2026-103909The Calculated Fields Form – AI Form Builder for WordPress –…6.1
• CVE-2026-103910Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-103912The JetFormBuilder — Dynamic Blocks Form Builder plugin for …4.7
• CVE-2026-103913The GeoDirectory plugin for WordPress is vulnerable to SQL I…7.5
• CVE-2026-103918oRPC is a tool that helps build APIs that are end-to-end typ…6.5
• CVE-2026-103921GraphQL Tools provides utilities for building, stitching, an…7.4
• CVE-2026-103922Capacitor is a cross-platform native runtime for web applica…9.3
• CVE-2026-103923KaTeX is a fast, easy-to-use JavaScript library for TeX math…2.1