Forminator Forms
Forminator Forms 1.57.2 and earlier can process untrusted current_url input as WordPress shortcodes. Update to 1.57.3 or later and review exposed forms and logs.
Forminator Forms 1.57.2 and earlier allows unauthenticated execution of registered WordPress shortcodes through the current_url parameter. The issue is CVE-2026-92229, rated Critical with CVSS 9.1 by Wordfence. Update to 1.57.3 or later. The plugin has more than 600,000 active installations, making this a high-priority check for site owners.
Exposure and technical cause
- Product: Forminator Forms WordPress plugin
- Affected versions: 1.57.2 and earlier
- Access required: None
- Attack class: Arbitrary execution of shortcodes registered on the affected site
- Fixed version: 1.57.3 and later
The Wordfence technical record identifies an untrusted current_url value being passed to WordPress’s do_shortcode() function without adequate validation. The outcome depends on which shortcodes are registered by the site’s theme and other plugins. Some may disclose data or trigger server-side actions; arbitrary PHP execution is not an automatic consequence of this flaw. Patchstack’s record identifies 1.57.3 as the fixed version. Public sources differ on exploitation status, so this advisory does not assert a confirmed attack against any particular site.
Fix and immediate containment
- Update Forminator to 1.57.3 or later from the official WordPress plugin directory or your trusted update channel.
- If you cannot update immediately, temporarily disable publicly accessible affected Forminator forms/quizzes or deactivate the plugin. A WAF rule may reduce exposure but is not a verified replacement for the fix.
- Review plugins and theme code that register shortcodes, especially ones that read private data, make external requests, or change site state. Restrict or remove unnecessary privileged shortcodes.
- Inspect application and web-server logs for unusual
current_urlvalues and associated requests, then review any actions those registered shortcodes could perform.
Verify and investigate
Confirm the installed version and update state:
wp plugin get forminator --fields=name,status,version,update --format=tableIf the plugin is below 1.57.3, update it and recheck the version. Review publicly accessible Forminator workflows after the update. For a suspected incident, preserve logs, check for unexpected admin accounts or content changes, and examine data accessible to any sensitive shortcode installed on the site. Do not rely on a successful version update alone to rule out prior abuse.
Sources
