Forminator Forms EUVD-2026-102646

Exploitation requires the vulnerable Forminator plugin (≤1.58.1) installed on a WordPress site, and specifically depends on deployment mode: the search-results GET vector requires a BLOCK THEME to be active, while the comment vector requires at least one post with comments enabled (both common defaults). No authentication, no user interaction, and no Forminator-specific forms, content, or configuration are needed to trigger execution. The practical IMPACT is limited by which shortcodes are registered on the target install - the flaw executes arbitrary registered shortcodes, not arbitrary PHP, so severity scales with the other plugins/shortcodes present rather than being guaranteed full compromise. The main limiting factor for the GET vector is the requirement for a block theme; classic-theme installs are not stated to be exploitable via the search path.

This is a genuine, elevated-priority issue despite its moderate 6.5 CVSS score, primarily because the exploitation barrier is exceptionally low. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the description reinforces this by describing two trivial trigger paths - a single unauthenticated GET to the search results page on any block-theme install, or an anonymous comment on any comment-enabled post - with no Forminator-specific content required. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no confirmed active exploitation or published exploit code at this time; the risk is driven by the inherent ease of abuse and the plugin's popularity rather than by observed in-the-wild activity. The scope is Unchanged (S:U) and impacts are rated Low for confidentiality and integrity with no availability impact, which tempers the raw severity: 'arbitrary shortcode execution' is NOT equivalent to direct arbitrary code execution despite the 'RCE' tag - actual impact depends entirely on which shortcodes are registered by the WordPress install and its other plugins. Net assessment: prioritize patching because the attack is unauthenticated and effortless, but recognize the real-world impact ceiling is bounded by available shortcodes, not guaranteed full server compromise.

An unauthenticated attacker sends a single crafted GET request to the search results page of a WordPress site running a block theme and the vulnerable Forminator plugin, embedding shortcode syntax that the plugin passes unvalidated into do_shortcode. Alternatively, the attacker submits an anonymous comment containing shortcode markup on any post with comments enabled. The injected shortcodes execute server-side with whatever capabilities the installed shortcodes expose; no public exploit code is identified at time of analysis, but the trigger is trivial to reproduce from the description.