CVE-2026-103911: Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.
Affected Software
Event History
Frequently Asked Questions
Which WordPress sites are exposed without needing a Forminator form or other plugin-specific setup?
Any site using a block theme can be exploited through a single unauthenticated GET request to its search-results page. No Forminator-specific content or configuration is required for this path.
Are sites using non-block themes still affected?
The issue can also be triggered by submitting an anonymous comment on any post where comments are enabled. This requires neither authentication nor Forminator-specific content or configuration.
What must an attacker be able to do to exploit the issue?
An attacker needs network access to the site and can exploit it without an account or user interaction. They can use the search parameter on a block-theme site or submit an anonymous comment where comments are enabled.