WPForms Lite CVE-2026-84744

No special conditions - remote unauthenticated exploitation against default configurations of WPForms Lite (versions 1.5.0.1 through 2.0.2) via any public form that echoes submitted field values back into the rendered form. Exploitation requires only that a WPForms form is present and reachable, and that the site has shortcodes registered whose execution yields useful effect (e.g. attachment/gallery shortcodes referencing non-public posts); the concrete impact is therefore bounded by which shortcodes exist on the target, and disclosure is limited to attachment details rather than full content, which caps confidentiality impact at Low.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5 Medium) is internally consistent with the description: an unauthenticated, network-reachable, low-complexity attack requiring no user interaction, yielding limited confidentiality and integrity impact. This is a shortcode-injection flaw, not memory-corruption RCE, so the 'RCE' tag overstates it - arbitrary execution of already-registered shortcodes is not equivalent to arbitrary system code execution, and the real-world impact is bounded by which shortcodes exist on the target site (information disclosure of non-public post attachment details being the concrete demonstrated effect). Publicly available exploit code exists (WPScan), which raises practical risk, but there is no EPSS score, no CISA KEV listing, and no SSVC framework data supplied, so exploitation is 'known-possible' rather than 'known-active'. The combination of a huge install base (WPForms Lite), unauthenticated reachability, and public POC makes this a genuinely elevated-priority patching item despite the mid-range CVSS, though it is not a critical takeover primitive. Note: CWE is 'N/A' in the input and CPE vendor is the placeholder 'unknown', so classification metadata is incomplete and should be corrected against the WPScan advisory.

An unauthenticated visitor submits a WPForms form with a field value containing WordPress shortcode delimiters (e.g. [gallery ...] or another registered shortcode); the plugin writes the raw value back into the rendered form without stripping the delimiters, so the shortcode executes in the site context and can, for example, disclose attachment details of non-public posts. Public exploit code is available via WPScan, lowering the skill barrier.