A critical vulnerability in the Forminator Forms plugin allows unauthenticated attackers to execute arbitrary shortcodes, potentially leading to full site compromise.

This vulnerability involves improper control of code generation, specifically a failure to validate input before passing it to the WordPress do_shortcode function. This flaw allows unauthenticated remote attackers to trigger arbitrary shortcodes within the application environment.

The ability to execute arbitrary shortcodes provides an attacker with a powerful primitive to manipulate site content, bypass security controls, or execute secondary payloads depending on the available shortcodes registered on the site. Given the CVSS score of 9.1, this vulnerability poses a severe risk to data integrity and system security. Unauthenticated access ensures that the barrier for exploitation is minimal, significantly increasing the likelihood of successful compromise.

Immediate Action: Update the Forminator Forms plugin to version 1.57.3 or later immediately to incorporate the required input validation fixes.

Proactive Monitoring: Review web server access logs for anomalous requests to the quiz or form action endpoints, specifically looking for unusual parameters passed to front-action PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious shortcode patterns or malformed POST requests targeting the plugin endpoints.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

This vulnerability represents a critical security risk due to the potential for unauthenticated remote code execution or site manipulation. Organizations using the Forminator Forms plugin must prioritize the update to version 1.57.3 to mitigate this threat. Failure to patch allows attackers to leverage the identified shortcode execution flaw, which could lead to a complete loss of site control.