Critical RCE + Public PoC Weekly Roundup: September 16–22, 2026

TL;DR

This week delivered five critical-severity vulnerabilities with confirmed RCE tagging and public proof-of-concept code, and none of them are theoretical. Three are unauthenticated WordPress plugin flaws — Forminator Forms, WP Recipe Maker, and two separate file-upload bugs in Gravity Forms and its Multi Uploader extension — that together expose a massive install base to remote code execution or data disclosure. A fifth item, a remote code execution flaw in Sogou Input Method for Windows, rounds out a week that spans web application and endpoint attack surfaces. Every item here has a public PoC, and all five are flagged as emergent threats in Watchstack monitoring. If you run WordPress at scale or manage Chinese-language Windows endpoints, this is a patch-now week.

Why this week matters

The common thread across all five CVEs is that exploitation requires no authentication and no user interaction. That combination collapses the time between disclosure and abuse. Public PoCs are already circulating on GitHub for each item, which means opportunistic scanners and low-sophistication actors can weaponize them without original research. For the WordPress flaws specifically, the attack surface is enormous: Forminator, WP Recipe Maker, and Gravity Forms are installed on hundreds of thousands of sites, and the vulnerable code paths are reachable by any anonymous visitor who can load a page or submit a form. The Sogou Input Method flaw is narrower in scope but sits on endpoints where input method software often runs with user-level or elevated privileges, making post-exploitation lateral movement a realistic concern. Patch windows this week should be measured in hours, not days, for internet-facing systems.

CVE spotlight table

CVE	Published	One-line risk	Patch/mitigate action
CVE-2026-92229	Sep 19, 2026	Forminator Forms ≤ 1.57.2 allows unauthenticated arbitrary shortcode execution via improper validation before do_shortcode.	Update Forminator Forms to the latest patched release immediately; if unavailable, disable the plugin or restrict form endpoints via WAF.
CVE-2026-89274	Sep 19, 2026	WP Recipe Maker ≤ 10.8.1 executes shortcodes in approved comment review text before sanitization, leaking data through JSON-LD on recipe pages.	Update WP Recipe Maker past 10.8.1; disable recipe ratings or require comment moderation until patched.
CVE-2026-84434	Sep 19, 2026	Gravity Forms ≤ 3.1.0.4 arbitrary file upload via hidden upload fields and rejected-file state reuse, enabling RCE.	Update Gravity Forms past 3.1.0.4; audit forms for File Upload fields with Hidden visibility and remove or restrict them.
CVE-2026-87796	Sep 17, 2026	Multi Uploader for Gravity Forms ≤ 1.1.9 fails file-type validation during chunked uploads, allowing unauthenticated arbitrary file write and potential RCE.	Update the plugin or remove it if no patch is available; block chunked upload endpoints at the WAF.
CVE-2026-51990	Sep 16, 2026	Sogou Input Method < 16.3.0.3498 allows remote code execution via the biz_helper.exe component.	Upgrade to Sogou Input Method 16.3.0.3498 or later on all managed endpoints.

Deep dives

CVE-2026-92229 — Forminator Forms unauthenticated shortcode execution

Forminator Forms is a widely deployed WordPress plugin used for contact forms, payment collection, quizzes, and custom workflows. The vulnerability in versions up to and including 1.57.2 stems from improper validation of a user-supplied value before it is passed to WordPress's do_shortcode() function. Because do_shortcode() evaluates every registered shortcode handler on the site, an unauthenticated attacker who can reach the vulnerable action can invoke any shortcode available — including those registered by other plugins and themes. The CVSS 3.1 base score is 9.1 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting a remotely exploitable, unauthenticated issue with high confidentiality and integrity impact. The trust boundary violated is between anonymous visitors and the server-side shortcode execution engine, and the attack prerequisites are minimal: network access to the WordPress site, no credentials, and no user interaction.

The practical impact depends heavily on which shortcodes are registered on the target site. Information disclosure is the most immediate concern — shortcodes that render private content or query the database can leak data directly into responses. Integrity violations are also possible, including content injection, tampering with form output, or triggering privileged actions exposed through shortcodes. In configurations where a shortcode handler itself is unsafe, the chain can escalate to remote code execution. A public proof-of-concept reference exists on GitHub, and the vulnerability was reported through Wordfence's disclosure process. Any WordPress site running Forminator at or below 1.57.2 should be considered at risk, especially if the plugin is internet-facing and forms are publicly accessible. Defenders should prioritize patching and, in the interim, review WAF logs for requests to Forminator-related endpoints that include shortcode tokens or unexpected parameter values.

CVE-2026-89274 — WP Recipe Maker shortcode execution and data disclosure

WP Recipe Maker is a staple on food, lifestyle, and content sites that rely on structured recipe metadata for rich search results. The flaw in versions through 10.8.1 is an arbitrary shortcode execution issue rooted in WPRM_Metadata::sanitize_metadata(), which recursively calls do_shortcode() on every scalar field of the recipe's structured metadata array. One of those fields, reviewBody, is populated verbatim from the comment_content of approved wprm-comment-rating comments. Because shortcode tokens are executed before any sanitization, the subsequent wp_strip_all_tags() and strip_shortcodes() calls operate only on the already-rendered output string and provide no protection. The CVSS 3.1 base score is 9.1 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

The attack requires that the attacker's rated comment pass the site's approval threshold, either through auto-approval or moderator action. Once approved, the shortcode executes on every recipe page render, and its output is embedded into the JSON-LD reviewBody metadata served to all visitors. This means leaked data — attachment captions, private post fields, user metadata, or other data surfaced by installed shortcodes — can persist in search engine indexes and CDN caches long after the vulnerable comment is removed. Integrity impact is possible when shortcodes perform state changes or render attacker-influenced markup. Business exposure includes SEO poisoning of structured data, reputational damage from leaked content, and downstream abuse if exposed data includes internal identifiers or email addresses. Site owners should update past 10.8.1 and, until patched, consider disabling recipe ratings or requiring manual moderation for all comments containing shortcode-like syntax.

CVE-2026-84434 — Gravity Forms arbitrary file upload leading to RCE

Gravity Forms is one of the most widely deployed form builders in the WordPress ecosystem, and this vulnerability in versions up to and including 3.1.0.4 is the highest-scored item in this week's roundup at CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the upload_file handling path and is reachable without authentication whenever a publicly accessible form contains a File Upload field whose Visibility is set to "Hidden." The root cause is a logic mismatch between the validation pipeline that inspects an uploaded file's extension and the persistence pipeline that writes the file to disk. Hidden upload fields bypass the extension allow-list checks that normal visible fields receive, and when a file is rejected during validation, the plugin does not fully discard the upload state — that intact state can later be handed to upload_file() without a second validation pass.

The result is a classic CWE-434 unrestricted upload pattern compounded by insufficient input validation and a state-management weakness. An unauthenticated attacker can place a file of their choosing on the web server, including file types that may be executable in the WordPress/PHP context. In the worst case this yields remote code execution under the web server's user account, which is a full compromise of the application tier. Realistic post-exploitation outcomes include webshell persistence, theft of database credentials and WordPress salts from wp-config.php, lateral movement to adjacent internal services, and use of the site as a staging point for further attacks. A public proof-of-concept repository exists on GitHub, and EPSS sits at roughly 0.0276 (about the 85.6th percentile). Site owners should update Gravity Forms past 3.1.0.4 immediately and audit all forms for File Upload fields with Hidden visibility, removing or restricting them until the patch is applied.

CVE-2026-87796 — Multi Uploader for Gravity Forms chunked upload bypass

Multi Uploader for Gravity Forms extends the Gravity Forms form builder with chunked upload capabilities, and versions through 1.1.9 fail to validate file types during that chunked upload handling. The flaw lives in the move_file function, which reassembles uploaded chunks and moves the completed file into its final storage location without adequately enforcing the expected file type across the chunked path. The CVSS 3.1 base score is 9.8 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This maps to CWE-434 and often overlaps with CWE-436 interpretation conflicts when different layers disagree about what a file is. The attack requires no credentials and no user interaction, and successful writes typically land in a web-accessible directory in standard WordPress deployments, which is what elevates a file-write bug into a potential RCE primitive.

An unauthenticated attacker who can write arbitrary files to a WordPress host can typically place a PHP web shell or dropper in an uploads directory and invoke it over HTTP to run commands as the web server user. Post-exploitation paths include reading wp-config.php to harvest database credentials and salts, pivoting to the underlying database, installing persistent backdoors or rogue administrator accounts, and using the host as a staging point for further internal reconnaissance. The source intelligence does not specify the exact patched version, so defenders should treat all versions through 1.1.9 as vulnerable until the vendor publishes a fixed release. If no patch is available, removing the plugin or blocking chunked upload endpoints at the WAF are the most direct mitigations. EPSS is modest at 0.00611 (roughly the 47th percentile), but the public PoC and emergent-threat tagging should drive triage above typical plugin CVEs.

CVE-2026-51990 — Sogou Input Method RCE via biz_helper.exe

Sogou Input Method is a widely used Chinese-language input method for Windows, and versions prior to 16.3.0.3498 contain a remote code execution flaw reachable through the biz_helper.exe component. The CVSS 3.1 base score is 9.8 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning a network-reachable, low-complexity attack with no privileges or user interaction required. The exact weakness class is not specified in available intelligence, but the vector and RCE outcome are consistent with a memory-safety or unsafe-deserialization style flaw in a network-reachable helper process. The vendor has fixed the issue in version 16.3.0.3498, and a public proof-of-concept reference exists on GitHub.

Successful exploitation allows arbitrary code execution in the context of the vulnerable helper process, which means an attacker could run commands, install additional tooling, or move laterally using the privileges available to biz_helper.exe. Because input method software often runs with user-level or sometimes elevated privileges and is present on many workstations, the business exposure can be significant in environments with large Chinese-language user bases. EPSS is currently low at 0.00355 (percentile 0.29072), but the public PoC and emergent-threat tagging raise the practical risk. Endpoint administrators should inventory Sogou Input Method installations, prioritize systems where the input method is installed by default or widely used, and upgrade to 16.3.0.3498 or later. Where immediate patching is not possible, consider application allow-listing or network isolation for affected endpoints.

What is not on CISA KEV yet

All five vulnerabilities in this week's roundup are flagged as emergent threats in Watchstack monitoring and are not currently listed in the CISA Known Exploited Vulnerabilities catalog. That distinction matters for defenders who use KEV as a triage gate: these items will not appear in KEV-driven dashboards or automated remediation workflows, and they may be deprioritized by teams that rely solely on KEV status to trigger urgent action. The absence of a KEV listing does not mean the risk is theoretical — each item has a public proof-of-concept, and the WordPress flaws in particular are reachable by unauthenticated attackers on internet-facing sites. Defenders should treat emergent-threat tagging as a leading indicator and apply the same urgency they would to a KEV item, especially for systems exposed to the public internet. Monitor for KEV additions in the coming days, but do not wait for them to begin remediation.

Defender checklist

1. Inventory exposed WordPress sites and plugins. Identify all instances of Forminator Forms (≤ 1.57.2), WP Recipe Maker (≤ 10.8.1), Gravity Forms (≤ 3.1.0.4), and Multi Uploader for Gravity Forms (≤ 1.1.9). Include staging, development, and forgotten subdomains — these are frequently internet-facing and unpatched.
2. Patch or mitigate the WordPress plugin flaws immediately. Update each plugin to the latest patched release. If no patch is available for Multi Uploader for Gravity Forms, remove the plugin or block chunked upload endpoints at the WAF. For Forminator and WP Recipe Maker, disable the affected features (public forms, recipe ratings) until patching is complete.
3. Audit Gravity Forms configurations for hidden upload fields. Search all forms for File Upload fields with Visibility set to "Hidden." Remove or restrict these fields until Gravity Forms is updated past 3.1.0.4. This is the specific precondition for exploitation of CVE-2026-84434.
4. Review WAF and web server logs for exploitation attempts. Look for requests to Forminator-related endpoints containing shortcode tokens, chunked upload requests to Multi Uploader endpoints, and POST requests to Gravity Forms upload handlers with unexpected file extensions. Correlate with comment submissions containing shortcode-like syntax on recipe pages.
5. Inventory and patch Sogou Input Method on managed endpoints. Identify all systems running versions below 16.3.0.3498 and upgrade to 16.3.0.3498 or later. Prioritize endpoints where the input method is installed by default or widely used, and consider application allow-listing for biz_helper.exe where immediate patching is not feasible.
6. Run validation scans after patching. Confirm that plugin versions have updated, that hidden upload fields are removed or restricted, and that Sogou Input Method reports the patched version. Re-scan for any remaining vulnerable instances, including those that may have been missed in the initial inventory.
7. Brief your SOC and incident response teams. Ensure detection rules cover the specific exploitation patterns for each CVE, and that IR playbooks include steps for webshell detection, wp-config.php credential rotation, and endpoint isolation for the Sogou Input Method flaw.

FAQ

Are these vulnerabilities actively exploited in the wild? All five items are flagged as emergent threats in Watchstack monitoring and have public proof-of-concept code available. While none are currently listed in CISA KEV, the combination of critical severity, unauthenticated attack vectors, and public PoCs means exploitation is likely and defenders should treat them as urgent. The WordPress flaws in particular are reachable by any anonymous visitor and are attractive targets for opportunistic scanning.

What is the difference between emergent-threat tagging and CISA KEV? CISA KEV is a formal catalog of vulnerabilities with confirmed exploitation in the wild, maintained by the U.S. Cybersecurity and Infrastructure Security Agency. Emergent-threat tagging in Watchstack monitoring is a leading indicator that flags critical vulnerabilities with public PoCs and confirmed RCE tagging before they may appear in KEV. Emergent items often become KEV items, but waiting for KEV status can leave a window of exposure that attackers will exploit.

Which of these should I patch first? Prioritize based on exposure and exploitability. CVE-2026-84434 (Gravity Forms) and CVE-2026-87796 (Multi Uploader for Gravity Forms) are the highest-scored at CVSS 9.8 and lead directly to remote code execution, so they should be first if you run those plugins on internet-facing sites. CVE-2026-92229 (Forminator) and CVE-2026-89274 (WP Recipe Maker) are CVSS 9.1 and also unauthenticated, so they follow closely. CVE-2026-51990 (Sogou Input Method) is endpoint-scoped and should be patched on managed Windows systems, with priority for environments with large Chinese-language user bases.

What if I cannot patch immediately? Apply compensating controls. For WordPress plugins, disable the affected features (public forms, recipe ratings, file uploads) or remove the plugin entirely if it is not business-critical. Use WAF rules to block requests to vulnerable endpoints and monitor logs for exploitation attempts. For Sogou Input Method, consider application allow-listing or network isolation for affected endpoints. Document your risk acceptance and set a firm patch deadline — these are unauthenticated RCE-class flaws, and the public PoCs lower the barrier for abuse.