Threat Overview
Forminator Forms is a popular form, quiz, and poll builder active on more than 600,000 WordPress websites worldwide. A critical security flaw tracked as CVE-2026-92229 enables unauthenticated visitors to execute arbitrary WordPress shortcodes by manipulating standard URL query parameters. Rated CVSS 9.1, this vulnerability allows external attackers to invoke privileged internal functions, exfiltrate sensitive configuration data, and chain secondary exploits without possessing login credentials.
| Threat Metric | Technical Details |
|---|---|
| Severity Rating | CRITICAL (CVSS 9.1 / 10.0) |
| Vulnerability Class | Improper Neutralization of Special Elements used in an Expression / Shortcode Injection (CWE-94) |
| Vulnerable Components | Forminator plugin, all versions up to and including 1.57.2 |
| Attack Vector | Unauthenticated HTTP GET or POST request manipulating the current_url parameter |
| Exploitation Status | Disclosed by security researchers; patch available in repository; automated scanning expected |
| Fixed Version | 1.57.3 |
The Breakdown: How the Exploit Works
The vulnerability occurs in how Forminator handles page context tracking during dynamic form rendering and AJAX submissions.
To maintain state and render tracking, the plugin extracts the current_url parameter from incoming client requests. Instead of sanitizing and treating this value strictly as a static URL string, the plugin passes the parameter through internal processing routines that evaluate WordPress shortcodes.
An unauthenticated attacker supplies crafted shortcode expressions inside the current_url parameter. When the page renders, WordPress executes the nested shortcodes within the server context. Depending on other plugins and themes installed on the target website, attackers invoke shortcodes that disclose database entries, reveal API keys, or trigger privileged administrative handlers.
The Operational Risk: What an Attacker Gains
Shortcode execution vulnerabilities represent an unpredictable threat multiplier because their impact scales with the third-party plugins installed on the site.
An attacker scanning for unpatched Forminator installations can chain shortcodes provided by page builders, membership systems, or e-commerce suites to bypass authentication, expose confidential customer communications, or write malicious scripts into template files. Because the request appears as a standard page view with query parameters, traditional security plugins frequently fail to flag the malicious payload.
Our Take in Plain English
“Shortcodes were introduced to make adding interactive widgets simple for content editors. But in a dynamic monolithic system like WordPress, mixing URL parameters with code evaluation engines creates continuous security vulnerabilities. A visitor viewing a web page should never be able to pass text that the server interprets as executable instructions. Modern pre-rendered architecture compiles user-facing pages into pure, static markup where dynamic server evaluation is eliminated by design.”
The Modern Architectural Remedy
- Legacy Dynamic Platform: Dynamically evaluates URL parameters and shortcode expressions inside a shared PHP server process on every page request.
- Modern Pre-Rendered Architecture: Pre-renders all structural content and widgets into static edge delivery assets, completely removing server-side shortcode evaluation engines.
Immediate Action Items for WordPress Operators
- Update Immediately: Update the Forminator plugin to version 1.57.3 or later via the WordPress Dashboard or WP-CLI.
- Review Query Logs: Check web server access logs for anomalous GET or POST requests containing bracketed shortcode syntax in URL query parameters.
- Audit Installed Plugins: Review all active plugins to ensure no vulnerable shortcode handler can be leveraged in secondary attack chains.
- Deploy Edge WAF Rules: If updates cannot be deployed immediately, implement edge firewall rules to block requests containing shortcode patterns in query strings.