Formidable Forms passes request input into server-side shortcode execution
Formidable Forms from 6.34 up to but not including 6.35 substitutes a request-derived value for a supported token in a form's custom HTML without preventing that value from reaching the WordPress shortcode parser. An unauthenticated visitor can cause arbitrary registered shortcodes with attacker-chosen attributes to run on a page displaying an affected form. Impact depends on the shortcodes registered on the site and their authorization checks; arbitrary PHP execution is not established. The export does not name the token, request parameter or parsing function.
- Component
- Formidable Forms
- Plugin slug
formidable- Affected
- 6.34 to < 6.35
- Safe version
6.35- Published
- Sep 16, 2026
This CVE was published Sep 16, 2026 and is one of 12 known issues for this plugin.
Update, patch or deactivate.
Update Formidable Forms to 6.35 or later. Keep request-derived token values out of shortcode parsing and treat them as escaped display data. If shortcode expansion is needed, allowlist intended shortcodes and attributes and enforce their capabilities independently. Remove the affected token usage or disable affected forms until updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N