Forminator Forms Bug Lets Attackers Run Shortcodes via Quiz Parameter

Executive Summary

A critical arbitrary shortcode execution vulnerability (CVE-2026-92229) has been disclosed in Forminator Forms – Contact Form, Payment Form & Custom Form Builder, a WordPress plugin with over 600,000 active installations. Rated CVSS 9.1, the flaw lets unauthenticated attackers execute arbitrary registered WordPress shortcodes through the plugin's quiz feature.

CVSS Score: 9.1 (Critical)

The vulnerability is tied to the current_url parameter processed during quiz submissions. In affected versions, the user-supplied current_url value is reflected into quiz result HTML — including social-share attributes — and the response buffer is subsequently run through do_shortcode() without validating the value first. An attacker can submit a quiz directly to admin-ajax.php with a crafted current_url containing a malicious shortcode and have it executed server-side.

Vulnerability Overview

Note: this is a distinct issue from the earlier CVE-2026-15748 (CVSS 9.8), an unauthenticated file-upload RCE affecting Forminator versions up to 1.56.1 that was patched separately.

Affected Versions

Attack Vector

1. Attacker locates a site running a vulnerable Forminator quiz form
2. Attacker POSTs a quiz submission directly to /wp-admin/admin-ajax.php
3. Request includes a crafted current_url parameter embedding a shortcode payload
4. Forminator reflects current_url into the quiz result HTML unvalidated
5. do_shortcode() executes the embedded shortcode server-side on the response buffer
6. Shortcode output — potentially sensitive — is rendered back to the requester

Because the request targets admin-ajax.php directly, no page rendering or visible form interaction is required — this makes the flaw straightforward to script and scan for at volume, and public proof-of-concept exploit tooling is already circulating.

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 1.57.3

# Via WP-CLI
wp plugin update forminator
 
# Verify the installed version
wp plugin get forminator --field=version

Or update through WordPress admin: Plugins > Installed Plugins > Forminator > Update Now.

Step 2: Review Quiz Forms

1. Identify all published Forminator quiz forms in Forminator > Quizzes
2. Temporarily unpublish or disable quizzes if patching cannot happen immediately
3. Confirm no unexpected shortcode output appears in quiz result pages

If Immediate Patching Is Not Possible

1. Disable or unpublish quiz forms until the update is applied
2. Block direct requests to admin-ajax.php with Forminator quiz actions at the WAF level where feasible
3. Monitor logs for unusual POST volume against admin-ajax.php

Detection Indicators

Post-Remediation Steps

1. Confirm plugin updated to 1.57.3 or later
2. Review access logs for prior exploitation attempts against admin-ajax.php
3. Audit quiz configurations for unexpected content or leaked data
4. Rotate any credentials that may have been exposed through leaked shortcode output
5. Deploy a WAF to catch shortcode-pattern payloads in AJAX request parameters

References

• The Hacker News — Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
• NIST NVD — CVE-2026-92229

Related Reading

• WP Recipe Maker Flaw Lets Attackers Run Shortcodes via Recipe Ratings
• Gravity Forms Unauthenticated File Upload Lets Attackers Achieve RCE
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+