The vulnerability in the Create custom forms for WordPress plugin allows an unauthenticated attacker to supply an unvalidated value that is passed to do_shortcode, enabling arbitrary shortcode execution. This is a form of code injection (CWE‑94) that can lead to arbitrary code execution on the host environment, potentially compromising confidentiality, integrity, or availability of the affected WordPress site.

The plugin is affected through version 1.2.4 inclusive, version 1.2.4 and earlier. The affected vendor is dorinabc, and the product is the Form builder for WordPress plugin known as Create custom forms for WordPress with a smart form plugin for smart businesses.

The CVSS score of 7.3 classifies this as a high‑severity vulnerability, and the EPSS score of 2% indicates a moderate probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated user delivering a crafted shortcode payload via any request that triggers the plugin’s shortcode processing. If exploited, an attacker can run arbitrary code on the server.