The WPForms Lite plugin versions >=1.5.0.1 and <2.0.2.1 do not sanitize submitted field values by removing shortcode delimiters before rendering them back into the form. This improper control of code generation (CWE-94) enables unauthenticated attackers to execute arbitrary shortcodes registered on the WordPress site. As a result, attackers can read details of attachments associated with non-public posts, potentially exposing sensitive information. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary shortcodes on the affected WordPress site, which may lead to unauthorized disclosure of information such as details of attachments tied to non-public posts. There is no indication of impact on availability. The confidentiality and integrity of data can be partially compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting the use of WPForms Lite plugin versions >=1.5.0.1 and <2.0.2.1 or applying custom filters to sanitize submitted field values to remove shortcode delimiters before rendering.