CVE-2026-92229: Critical RCE in Forminator WordPress Plugin — Public PoC, No KEV Listing Yet

TL;DR

CVE-2026-92229 is a critical (CVSS 9.1) unauthenticated arbitrary shortcode execution vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress, affecting all versions up to and including 1.57.2. A public proof-of-concept is available on GitHub, and the flaw can lead to remote code execution (RCE) when chained with other installed plugins that register dangerous shortcodes. As of this writing, CVE-2026-92229 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog — but the combination of unauthenticated access, a public exploit, and a 9.1 severity score makes this an urgent patch for any internet-facing WordPress site running Forminator.

If you run Forminator ≤ 1.57.2, treat this as an active emergency: update immediately, validate exposure, and hunt for exploitation artifacts.

What is CVE-2026-92229?

CVE-2026-92229 is an improper input validation flaw (CWE-94 family) in the Forminator Forms plugin developed by WPMU DEV. The plugin fails to properly validate a user-supplied value before passing it to WordPress's do_shortcode() function. This allows an unauthenticated attacker to inject and execute arbitrary WordPress shortcodes on the target site.

• Vendor / Product: WPMU DEV — Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WordPress plugin)
• Affected versions: All versions ≤ 1.57.2
• CVSS v3.1: 9.1 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• EPSS: 0.00402 (34.2 percentile) — low probability of exploitation in the next 30 days based on current signals, but this metric often lags behind public PoC availability.
• Public exploit: Yes — a GitHub PoC repository is publicly accessible.
• CISA KEV: Not listed as of this publication.

Why this is an emergent threat

Three factors elevate CVE-2026-92229 from "patch eventually" to "patch now":

1. Unauthenticated remote exploitation. The vulnerability requires no credentials and no user interaction. Any internet-facing WordPress site with the vulnerable plugin is a candidate target.
2. Public proof-of-concept. A working PoC is available on GitHub. This dramatically lowers the skill barrier for opportunistic attackers and script kiddies, and it accelerates weaponization timelines.
3. RCE potential via shortcode chaining. While the immediate impact is arbitrary shortcode execution, WordPress shortcodes are extensible. If the target site runs other plugins that register shortcodes capable of file operations, database queries, or code evaluation, an attacker can chain them to achieve full remote code execution.

The absence of a CISA KEV listing does not mean this is low risk. KEV inclusion often follows observed exploitation in the wild; with a public PoC already circulating, that listing may come later. Defenders should not wait for KEV to act.

Technical details

The root cause lies in the plugin's quiz front-end action handler. Specifically, code in library/modules/quizzes/front/front-action.php and the abstract class library/abstracts/abstract-class-front-action.php passes user-supplied input to do_shortcode() without adequate validation or sanitization.

WordPress's do_shortcode() function parses content and executes any registered shortcode it finds. Because Forminator exposes an action that processes form-related input and then calls do_shortcode() on that input, an attacker can craft a request containing arbitrary shortcode syntax (e.g., [some_shortcode]). The server will evaluate and execute that shortcode in the context of the WordPress site.

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code / Code Injection) and effectively CWE-20 (Improper Input Validation). The trust boundary violated is between unauthenticated visitors and the server-side shortcode execution engine.

All versions up to and including 1.57.2 are affected. There is no evidence of a partial fix in earlier releases.

Impact assessment

Successful exploitation gives an unauthenticated attacker the ability to execute arbitrary shortcodes. The downstream impact depends entirely on which shortcodes are registered on the target site:

• Confidentiality (High): Shortcodes may expose private content, user data, configuration details, or database query results.
• Integrity (High): Attackers can inject content, alter form output, modify site options, or trigger privileged actions exposed via shortcodes.
• Availability (None per CVSS): The CVSS vector rates availability impact as None, but resource exhaustion or site crashes are possible in practice.
• Remote Code Execution: If any installed plugin or theme registers a shortcode that performs file writes, command execution, or unsafe eval(), the attacker can escalate to full RCE.

Business exposure includes leakage of form submissions (which often contain PII), tampering with payment or contact workflows, reputational damage, and regulatory consequences under GDPR, CCPA, or similar regimes.

Exposure validation: are you affected?

1. Inventory your WordPress sites. Identify every instance running Forminator. Check both internet-facing and internal sites — internal sites are still at risk from lateral movement or insider threats.
2. Check the plugin version. In the WordPress admin, go to Plugins → Installed Plugins and locate Forminator. If the version is 1.57.2 or lower, you are vulnerable. You can also check the readme file at /wp-content/plugins/forminator/readme.txt or inspect asset version strings.
3. Assess internet exposure. Determine which sites are publicly accessible. Use external attack surface management (EASM) tools or Shodan/Censys queries for wp-content/plugins/forminator/.
4. Evaluate shortcode blast radius. List all active plugins and themes that register shortcodes. Pay special attention to any that allow file operations, database access, or code execution. These expand the impact from data disclosure to full RCE.
5. Review WAF and server logs. Look for requests to Forminator endpoints (e.g., admin-ajax.php with Forminator-specific action parameters) containing shortcode syntax ([ and ]) in unexpected fields.

Detection and hunting guidance

Defenders should hunt for the following indicators of compromise (IoCs):

• Network: Unauthenticated POST requests to wp-admin/admin-ajax.php or wp-json endpoints with Forminator quiz action parameters containing shortcode syntax (e.g., [ and ] characters in form fields).
• Logs: WordPress access logs showing high-frequency or anomalous requests to AJAX endpoints from a single IP or user agent. PHP error logs referencing unexpected shortcode execution from front-action.php or abstract-class-front-action.php.
• File system: Unexpected new files or modified content in the WordPress uploads directory, theme files, or plugin files. File integrity monitoring alerts for changes to wp-content.
• Process: Unusual PHP child processes or outbound network connections from the web server process, which may indicate shortcode-triggered code execution via other plugins.
• Authentication: New administrative users or privilege changes without a corresponding change ticket.

Correlate any suspicious requests with subsequent changes to posts, options, or unexpected outbound connections. Preserve logs and take a snapshot before remediation if exploitation is suspected.

Mitigation and patch path

1. Update Forminator immediately. The vendor has released a patched version newer than 1.57.2. Update via the WordPress admin or WP-CLI (wp plugin update forminator). Verify the version after updating.
2. If you cannot patch immediately:
   • Temporarily deactivate the Forminator plugin. This eliminates the attack surface but may break forms.
   • Implement WAF rules to block requests containing shortcode syntax in Forminator quiz action parameters. Many WAF vendors will release virtual patches.
   • Restrict access to vulnerable endpoints via IP allowlisting if feasible.
3. Post-patch actions:
   • Review server logs for signs of prior exploitation.
   • Audit any content created or modified through the vulnerable endpoint.
   • Rotate secrets and review user roles for unauthorized changes.
   • Enforce least privilege on WordPress accounts.
4. Long-term hardening:
   • Maintain a software bill of materials (SBOM) for WordPress plugins and themes.
   • Implement a continuous threat exposure management (CTEM) program that includes regular vulnerability scanning and patch management.
   • Monitor CISA KEV and vendor advisories for updates on this CVE.

CISA KEV status and what it means

CVE-2026-92229 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. This means U.S. federal agencies are not yet mandated to patch under Binding Operational Directive 22-01. However, the presence of a public PoC and the critical severity suggest that KEV inclusion may be imminent if exploitation is observed in the wild.

Do not wait for KEV. The public PoC lowers the barrier to entry for attackers, and unauthenticated RCE-capable flaws are prime targets for ransomware affiliates, initial access brokers, and opportunistic scanning. Treat this as a high-priority patch regardless of KEV status.

Community reactions and intelligence

The vulnerability was reported by Wordfence, which published a threat intelligence entry shortly after disclosure. Social media activity was observed on Mastodon (via @stemshop and @thehackerwire) and on the infosec.exchange instance, indicating moderate community awareness. A public proof-of-concept repository on GitHub has circulated, which lowers the barrier for opportunistic attackers.

Some defenders have noted that the lack of a specified CWE and vendor details complicates triage, while others emphasize that the public PoC and critical CVSS score should override uncertainty. No major vendor statements or in-depth researcher write-ups beyond the initial advisory have been identified at this time.

Trusteed perspective

At Trusteed, we treat emergent threats with public PoCs as high-priority items even before KEV listing. CVE-2026-92229 checks every box for a rapidly weaponized vulnerability: unauthenticated, remote, critical severity, and public exploit code. The WordPress ecosystem is vast, and Forminator is a popular plugin with a large install base. Attackers are actively scanning for vulnerable WordPress plugins; the window between PoC publication and mass exploitation is often measured in hours or days.

Our recommendation: if you run Forminator ≤ 1.57.2, patch now. If you cannot patch, mitigate aggressively. Validate your exposure, hunt for IoCs, and assume compromise if you see suspicious shortcode-like requests in your logs. Do not wait for CISA KEV.

FAQ

Q: Is CVE-2026-92229 in the CISA KEV catalog? A: No. As of this publication, CVE-2026-92229 is not listed in the CISA Known Exploited Vulnerabilities catalog. However, a public PoC exists, and the vulnerability is critical. Monitor the KEV catalog for updates.

Q: What versions of Forminator are affected? A: All versions up to and including 1.57.2 are vulnerable. Update to a version newer than 1.57.2.

Q: Can this lead to remote code execution? A: Yes, indirectly. The vulnerability allows arbitrary shortcode execution. If the site has other plugins or themes that register shortcodes capable of file operations, database queries, or code evaluation, an attacker can chain them to achieve RCE.

Q: Is authentication required to exploit this? A: No. The vulnerability is unauthenticated and remotely exploitable.

Q: What is the EPSS score, and does it matter? A: The EPSS score is 0.00402 (34.2 percentile), indicating a low probability of exploitation in the next 30 days based on current signals. However, EPSS often lags behind public PoC availability and real-world exploitation. The public PoC and critical severity are more actionable signals.

Q: How can I detect if my site has been exploited? A: Look for unauthenticated POST requests to admin-ajax.php or wp-json endpoints with Forminator action parameters containing shortcode syntax. Check for new or modified content, unexpected outbound connections, and file integrity changes. Review PHP error logs for references to front-action.php.

Q: What if I cannot patch immediately? A: Temporarily deactivate the plugin, implement WAF rules to block shortcode-like payloads targeting Forminator, and restrict access to vulnerable endpoints. Monitor logs closely for exploitation attempts.

Q: Where can I find more information? A: Refer to the GitHub Advisory (GHSA-2vrv-wr6r-v79v), Wordfence Threat Intelligence, and the WordPress plugin repository changeset. The public PoC is available at https://github.com/murrez/CVE-2026-92229.