Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.3 — Authenticated (Subscriber+) Arbitrary Shortcode Injection

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Forminator Forms – Contact Form, Payment Form & Custom Form Builder.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 1.58.4, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Forminator Forms – Contact Form, Payment Form & Custom Form Builder to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Filip Kowalski.

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.58.3. This is due to missing sanitization of shortcode brackets in user-controlled post title, content, and excerpt values submitted through the Post Data field, in the neutralize_shortcodes() call added to the sanitize() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject shortcodes into posts created through the Post Data field, causing arbitrary registered shortcodes to execute when the published post is rendered. A form with a Post Data field must be publicly accessible or accessible to the attacker's role.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Nov 3, 2026

   CVE published

   Severity medium, CVSS 5.4

2. Nov 13, 2026

   Record last updated