Loading vulnerability…
CVE-2026-92229 is an arbitrary shortcode-execution vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress through version 1.57.2. An externally supplied value reaches WordPress's do_shortcode function without adequate validation, allowing an unauthenticated remote attacker to cause execution of arbitrary WordPress shortcodes.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This five-file repository is a standalone Python 3 proof-of-concept scanner and exploitation tool for CVE-2026-92229 affecting the WPMU DEV Forminator WordPress plugin through version 1.57.2. The primary executable, poc.py, uses requests and urllib3, disables TLS certificate verification, supports optional proxying, and uses concurrent workers for mass scanning. It normalizes target URLs, fingerprints Forminator through publicly accessible plugin readme/main files and page asset versions, then crawls common public form paths to discover Forminator modules and quiz answers. In check mode, it identifies potentially exploitable targets by combining plugin/version detection with public quiz discovery and parseable answer fields. In exploit mode, it submits a Forminator quiz request to WordPress admin-ajax.php using the documented quiz AJAX action. The crafted current_url parameter contains a user-selected shortcode enclosed in caption tags, intended to reach Forminator's vulnerable result-HTML processing and WordPress do_shortcode() invocation. The tool can obtain a nonce and answers automatically when exposed in page HTML, or the operator can provide page URL, form ID, form type, and answer mappings manually. Preview mode uses the preview submission action to exercise the same path without storing a quiz entry. Supporting files are README.md with vulnerability details and usage guidance, requirements.txt listing requests and urllib3, targets.example.txt containing a placeholder mass-scan target, and an MIT LICENSE. The repository is not part of a recognized exploitation framework. It contains a functional exploit primitive but no integrated command-execution, persistence, or shell payload; the practical impact is determined by what WordPress shortcodes the victim installation provides.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated arbitrary-shortcode-execution vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. It results from inadequate validation of a value before it is passed to do_shortcode, affecting versions through 1.57.2.
An unauthenticated arbitrary-shortcode-execution vulnerability (CWE-94) in the Forminator Forms WordPress plugin through version 1.57.2, caused by insufficient validation before invoking do_shortcode. The listed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.