PT-2026-95746 · WordPress · Forminator Forms

Kuba

·

CVE-2026-92229

·

Published

2026-09-19

·

Updated

2026-09-23

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.3
Description Unauthenticated attackers can execute arbitrary shortcodes because the software fails to properly validate a value before running the do shortcode function. This issue is triggered via the current url parameter.
Recommendations Update Forminator Forms to version 1.57.3 or later. Avoid using the current url parameter until the update is applied.

Fix

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-92229

Affected Products

Forminator Forms