What’s Vulnerable › Vulnerabilities
CVE-2026-84744: WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-28 · updated 2026-09-28
- Weakness: CWE-94
Description
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.
Affected products
- smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: from 1.5.0.1 before 2.0.2.1 — fixed in 2.0.2.1
How to fix
Upgrade to a fixed version: smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More 2.0.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-84744 or the next vulnerability affects your stack