CVE-2026-101335: CWE-94 Improper Control of Generation of Code ('Code Injection') in wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

CVE-2026-101335 is a code injection vulnerability (CWE-94) in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. The vulnerability arises because the forminator_replace_quiz_form_data() function calls do_shortcode() on the notification body after substituting the {quiz_result} merge tag. Meanwhile, the {user_agent} and {refer_url} merge tags include attacker-controlled input from the User-Agent header and referer_url POST parameter, respectively, which are sanitized with sanitize_text_field()/esc_html() but still retain shortcode delimiters '[' and ']'. This allows unauthenticated attackers to inject and execute arbitrary WordPress shortcodes registered on the site by submitting a quiz with a notification template containing {quiz_result}. The severity is medium with a CVSS 3.1 score of 6.5, reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An unauthenticated attacker can execute arbitrary WordPress shortcodes by submitting a specially crafted quiz to the vulnerable Forminator Forms plugin. The actual impact depends on the shortcodes registered by other plugins or themes on the site and can include arbitrary content injection or information disclosure. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling quiz notifications or removing the {quiz_result} merge tag from notification templates to prevent shortcode execution. Monitor vendor channels for updates and apply patches promptly once released.