Formidable Forms CVE-2026-19857

Exploitation requires a WordPress site running Formidable Forms below 6.35 that has an attacker-reachable form whose custom HTML field contains a supported token (i.e. the form author enabled token substitution inside custom HTML) and that is displayed on a publicly reachable page; the injected value supplied through that request path is then re-parsed as a shortcode. The attacker must be able to reach the form's front-end endpoint unauthenticated - no account or role is needed, matching the CVSS PR:N/UI:N assessment that no victim interaction is required. What limits real impact: CVSS rates the vector AC:H precisely because the custom-HTML-plus-token configuration is not a default form layout, and the assessed impact is only C:L/I:L (no availability effect). Actual damage is capped by which shortcodes are registered on the target - on a stock site with no permissive shortcodes the payload may do little, whereas sites with powerful custom or third-party shortcodes face a much larger consequence. This is a stored/reflected execution on pages rendering the form, so any visitor viewing that page can trigger execution of the already-injected shortcode.

The signal set is internally consistent but points to a moderate, situational risk rather than a critical one. CVSS 3.1 rates it 4.8 with AV:N (network-reachable form endpoint), AC:H (exploitation depends on the form being configured with custom HTML containing a supported token), PR:N (unauthenticated), UI:N, and only low confidentiality and integrity impact (C:L/I:L/A:N) - no availability impact is claimed, meaning the parser does not crash or exhaust resources. EPSS is not supplied in the input, so no quantified exploitation probability can be cited, and KEV status is negative: despite a public WPScan exploit entry, this is not confirmed actively exploited (CISA KEV). The 'RCE' tag in the source metadata overstates the CVSS-assessed impact - arbitrary shortcode execution only escalates to remote code execution if a dangerous shortcode (file-inclusion, SQL, or a vulnerable add-on shortcode) happens to be registered on the target, which is an environmental condition, not a property of the CVE. Conversely, defenders should not dismiss it purely on 4.8: the vector is unauthenticated and remote, and the practical severity is bounded by the target's installed shortcode surface, which can be large on a heavily plugin-laden WordPress site. The AC:H rating and the custom-HTML-plus-token precondition are inferred from the description text; no separate vendor advisory confirms the exact required configuration, so treat that precondition as high-confidence but not vendor-verified.

An unauthenticated attacker locates a published Formidable Forms form on a target WordPress site that uses a custom HTML block with a token substitution, then submits crafted form input containing a shortcode such as a file-display or plugin-specific shortcode with attacker-chosen attributes. The plugin replaces the token with the submitted value inside the custom HTML and hands the result to the shortcode parser, so the payload is executed server-side - including on subsequent page views of that form - without any login or user interaction on the victim's part. Publicly available exploit code exists per WPScan, but the attack succeeds only when the site's shortcode surface includes something worth abusing.