The Forminator Forms plugin for WordPress has a flaw that allows uncontrolled execution of WordPress shortcodes through an unsanitized search parameter and the render_block function. This vulnerability, classified as CWE-94, enables attackers to inject and run arbitrary code using shortcodes that may perform destructive actions or provide backdoor access. Because the plugin calls do_shortcode without validating the input, the attacker can trigger any shortcode present on the site, creating a serious risk of remote code execution.

The vulnerability affects all releases of the WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin up to and including version 1.58.1. This includes every site that has installed any older version of the plugin regardless of configuration.

The CVSS score of 6.5 indicates a moderate severity risk. An unauthenticated attacker can exploit the issue in two straightforward ways: by sending a single GET request to the search results page or by submitting an anonymous comment on any post with comments enabled. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the simplicity of the attack vector and lack of authentication requirements mean the potential impact remains significant.