CVE-2026-92229 — Forminator ≤ 1.57.2 Unauthenticated Shortcode Execution
September 25, 2026 · 431 views
Unauthenticated arbitrary shortcode execution in **Forminator** (≤ 1.57.2) via **`current_url`** in quiz-related AJAX handlers.
Description
Overview
CVE-2026-92229 affects Forminator (≤ 1.57.2), a WordPress forms and quiz plugin. The current_url parameter in quiz AJAX endpoints is reported to allow unauthenticated shortcode execution.
Impact
Shortcode execution can expose secrets or achieve code execution depending on installed shortcodes and WordPress hardening.
Remediation
Update Forminator to the latest vendor release. Disable unused quiz modules if you cannot patch immediately.
Legal and ethical use
Use bundled tools only on WordPress sites you own or have written authorization to test. Unauthorized scanning or exploitation is illegal in most jurisdictions.
References
- Look up the CVE ID on NVD and the CVE Program for official records.
- Apply vendor/plugin updates from the official repository or vendor advisory before relying on any PoC.
Related PoCs
Same platform, vendor, or tags — explore more write-ups on Pocbit.
- WordPressCVE-2026-92966critical
CVE-2026-92966 — WordPress LatePoint ≤5.7.0 Stored Shortcode Execution (Customer Cabinet)
LatePoint appointment booking ≤5.7.0: unauthenticated guest booking stores [shortcode] in customer first/last name (sanitize_text_field keeps brackets); Customer Cabinet block renders welcome line then the_content do_shortcode runs twice → arbitrary shortcode execution. CVSS 9.1 Critical (CWE-94). Fixed in 5.7.1. No API key. Python PoC: check, mass exploit, --lab, optional POCBIT_EXEC_SHORTCODE. Marker POCBIT-92966-OK.
- WordPressCVE-2026-89274high
CVE-2026-89274 — WP Recipe Maker ≤ 10.8.1 Unauthenticated Shortcode Execution
Unauthenticated arbitrary shortcode execution in WP Recipe Maker (≤ 10.8.1) through approved recipe rating comments and **reviewBody** JSON-LD handling.
- WordPressCVE-2026-18143critical
CVE-2026-18143 — Addify Request a Quote for WooCommerce Unauthenticated File Upload
Unauthenticated arbitrary file upload (CWE-434, CVSS 9.8 Critical) in Request a Quote for WooCommerce ≤ 2.9.2 via public AJAX afrfq_submit_quote_via_popup — unsafe move_uploaded_file() with attacker-controlled .php names into web-accessible RFQ temp storage. Requires popup quote rule on the storefront.
- WordPressCVE-2026-19660critical
CVE-2026-19660 — Divi Membership (DiviEngine) ≤2.3.0 paypal_param Authentication Bypass
DiviEngine Divi Membership ≤2.3.0: process_paypal_callback on init trusts base64 paypal_param GET without PayPal/IPN validation → wp_set_current_user + wp_set_auth_cookie as arbitrary user ID (incl. admin). PayPal gateway class loads even when disabled. CVSS 9.8 Critical (CWE-287). Python PoC: check/exploit, cookie export, mass scan.