Forminator Forms CVE-2026-101335

Requires a published Forminator quiz form whose email/notification template contains the {quiz_result} merge tag, because do_shortcode() is only invoked on the expanded notification body after that tag is substituted - this is a non-default configuration choice by the site operator. The attacker-controlled injection points are the HTTP User-Agent header and the referer_url POST parameter, which flow through sanitize_text_field()/esc_html() without '[' or ']' being stripped. Realized impact is further limited by, and entirely dependent on, which shortcodes are registered by other installed plugins/themes; a site with no dangerous registered shortcodes suffers little practical impact. No authentication is required (CVSS PR:N), and no user interaction is needed, but the quiz-notification precondition is the primary real-world limiting factor.

The official CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5 MEDIUM) describes an unauthenticated, network-reachable flaw requiring no user interaction, which argues for easy triggering. However, the impact signals are deliberately modest (C:L/I:L/A:N) because the vulnerability only grants execution of WordPress shortcodes already registered by OTHER installed plugins/themes - not native PHP/OS code execution - so the real-world severity is entirely dependent on which shortcodes are exposed. Critically, exploitation also depends on a non-default condition (a published quiz whose notification body contains the {quiz_result} merge tag), which meaningfully lowers the universal attack-complexity picture versus what AC:L suggests; I assess this as AC:H / CVSS 4.0 AT:P. No EPSS score, no CISA KEV listing, no SSVC decision data, and no public POC are present in the provided intelligence, so there is no evidence of active or at-scale exploitation. Net judgment: this is a legitimate unauthenticated vulnerability worth patching promptly on affected sites, but it is a conditional, bounded-impact issue rather than a drop-everything emergency; the absence of EPSS/KEV/SSVC signals should be treated as 'unknown,' not as 'safe.'

An unauthenticated attacker locates a WordPress site running Forminator (≤1.58.1) with a quiz form whose email/notification template includes the {quiz_result} merge tag. They submit the quiz while placing a shortcode payload (e.g. '[some_registered_shortcode]') in the User-Agent header or the referer_url POST parameter; because sanitize_text_field()/esc_html() do not strip '[' and ']', the payload survives into the notification body that do_shortcode() later expands, causing arbitrary registered shortcodes to execute. No public exploit identified at time of analysis, and realized impact depends on which shortcodes other installed plugins/themes expose.