CVE-2026-92229PoC

MEDIUMCVSS 9.1 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-94

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 3 signals
PoC mentioned or linked in 6 signals
Patch or workaround mentioned in 8 signals
Technical details provided in 13 signals
Disclosure: 2 classified signals
Peaked 1d ago at 5 mentions (2026-09-22); latest day: 2
13 total mentions across 5 days

Deep dive

Activity timeline13 mentions / 5d

Signal classification4 categories

PoC

646.2%

Patch

430.8%

Disclosure

215.4%

General

17.7%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-19	3	Patch2PoC1
2026-09-20	1	PoC1
2026-09-21	2	Disclosure1Patch1
2026-09-22	5	Disclosure1Patch1PoC3
2026-09-23	2	General1PoC1

Full discourse13 posts

ThreatWire@ThreatWire_42d
PoC
🚨 PoC RELEASED: A public exploit for CVE-2026-92229, a CRITICAL WordPress Forminator vulnerability (CVSS 9.1), is now available. The flaw allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation before do_shortcode is called. ⚠️ Forminator versions up to and including 1.57.2 are affected. 🔴 Update Forminator to 1.57.3 or later. 🔗 https://github.com/murrez/cve-2026-92229 #WordPress #Forminator #CVE #PoC #CyberSecurity #Infosec
Post summary
A public PoC has been released for CVE-2026-92229, a critical WordPress Forminator vulnerability (CVSS 9.1), affecting versions up to 1.57.2, with users advised to update to 1.57.3 or later.
1270117769.5K
1.9K followersView on X
Rıdvan Yağlı@ridvanyagli45d
PoC
🔴 Forminator adlı WordPress eklentisinde CVE-2026-92229 (CVSS: 9.1) kritik güvenlik açığı için public PoC yayınlandı. WPMU DEV Forminator'da kimlik doğrulaması gerektirmeyen arbitrary shortcode execution açığı bulunuyor. current_url parametresi üzerinden Quiz AJAX endpoint'leri hedeflenebiliyor. Etkilenen sürümler: ≤1.57.2 Yamalanan sürüm: 1.57.3+ Özellikle public Quiz kullanan WordPress sitelerinin güncellenmesi öneriliyor. PoC: https://github.com/murrez/CVE-2026-92229
Post summary
The tweet announces a critical vulnerability in Forminator with a public PoC, detailing the arbitrary shortcode execution and recommending an upgrade to 1.57.3+.
03037162.4K
2.5K followersView on X
Ryx@PadhiyarRushi41d
PoC
Forminator quiz AJAX feeds attacker current_url straight into do_shortcode()!!! CVE-2026-92229 (CVSS 9.1). Forminator ≤1.57.2 reflects current_url into quiz-result HTML, then WordPress shortcode-parses the whole buffer. Unauthenticated POST to forminator_submit_form_quizzes / forminator_submit_preview_form_quizzes = arbitrary shortcodes. Python PoC landed this week. Patch: 1.57.3. https://github.com/murrez/CVE-2026-92229 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WordPress #BugBounty #AppSec
Post summary
The post details CVE-2026-92229, an unauthenticated shortcode injection in Forminator ≤1.57.2 (CVSS 9.1), notes a Python PoC released this week with a GitHub link, and indicates that version 1.57.3 patches the flaw.
0201110613
954 followersView on X
株式会社mgn@mgn_jpn46d
Patch
🚨 Forminator Forms – Contact Form, Payment Form & Custom Form Builder に脆弱性（深刻度緊急） 60万サイト以上が利用 / CVSS 9.1 修正版 1.57.3 が公開済み https://shindan.m-g-n.me/alerts/cve-2026-92229/
Post summary
The tweet discloses a critical vulnerability (CVSS 9.1) in the Forminator Forms WordPress plugin affecting over 600,000 sites and highlights that a fixed version (1.57.3) has been released.
00033510
425 followersView on X
ExploitGrid@exploitgrid42d
Patch
🚨 CRITICAL | CVSS 9.1 — WordPress Forminator CVE-2026-92229 is a shortcode execution vulnerability affecting WordPress Forminator. 💥 Impact: Arbitrary Shortcode Execution 🔹 CVSS: 9.1 Critical 🔹 Affected: Forminator ≤ 1.57.2 🔹 Fixed: 1.57.3+
Post summary
The post discloses a critical arbitrary shortcode execution vulnerability in WordPress Forminator (CVE-2026-92229) with CVSS 9.1, affecting versions up to 1.57.2 and fixed in 1.57.3+.
1103049
403 followersView on X
mürrez@murrezsec45d
PoC
Just released the PoC for CVE-2026-92229! 🚨 🛡️ Vulnerability: Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution (via current_url parameter) 🔗 Details & PoC: https://github.com/murrez/CVE-2026-92229 #CyberSecurity #Infosec #WordPress #PoC #Vulnerability
Post summary
The tweet announces a proof‑of‑concept for CVE‑2026‑92229, detailing an unauthenticated arbitrary shortcode execution flaw in Forminator Forms ≤1.57.2 and provides a GitHub link to the PoC.
00030156
636 followersView on X
ExploitGrid@exploitgrid42d
PoC
The flaw allows unauthenticated attackers to execute arbitrary shortcodes due to insufficient validation before do_shortcode() is called. 🔗 PoC: https://github.com/murrez/cve-2026-92229 #WordPress #Forminator #CVE #PoC #CyberSecurity #InfoSec
Post summary
The tweet announces a WordPress CVE with technical details and shares a GitHub PoC link, indicating a proof of concept is available.
0001044
202 followersView on X
dbugs@ptdbugs42d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-92229 PT ID: PT-2026-95746 Vendor: WordPress / WPMU DEV Product: Forminator Forms – Contact Form Description: The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. References: • https://dbu.gs/vulnerability/PT-2026-95746 • https://github.com/murrez/cve-2026-92229
Post summary
A proof‑of‑concept/exploit has been released for CVE‑2026‑92229, affecting WordPress Forminator Forms (≤ 1.57.2) and enabling unauthenticated arbitrary shortcode execution.
00001431
3.6K followersView on X
WP Security Ninja@WPSecurityNinja43d
Patch
Forminator Forms ≤1.57.2 has an unauthenticated shortcode-execution hole (CVE-2026-92229). If you run quizzes or forms with it, update to 1.57.3 now. No login needed for the bad request. https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-forms-plugin-1-57-2-unauthenticated-arbitrary-shortcode-execution-via-current-url-parameter-vulnerability #WordPress #WordPressSecurity
Post summary
The tweet reports CVE-2026-92229, an unauthenticated shortcode execution flaw in Forminator Forms ≤1.57.2, and advises updating to version 1.57.3, confirming a patch is available.
0001070
359 followersView on X
LoreleiWeb@LoreleiWeb43d
Disclosure
🆕👉 Forminator Forms https://wpdeeply.com/forminator-forms-1-57-2-unauthenticated-shortcode-execution-cve-2026-92229/ #loreleiweb Forminator Forms 1.57.2 and earlier allows unauthenticated execution of registered WordPress shortcodes through the current_url parameter. The issue is CVE-2026-92229, rated Critical with CVSS 9… https://WordPress.org https://t.co/xJ2SKd1ycg
Post summary
The tweet announces CVE-2026-92229 in Forminator Forms ≤1.57.2, describing unauthenticated shortcode execution via the current_url parameter with a Critical CVSS 9 rating, and links to a blog post for further details. No PoC, exploit tool, patch, or active exploitation evidence is mentioned in the text itself.
00010225
85.8K followersView on X
ADK Cyber@ADKCyber45d
Patch
CVE-2026-92229 (CVSS 9.1): Forminator Forms WordPress plugin vulnerable to arbitrary shortcode execution up to v1.57.2. Update if in use: https://nvd.nist.gov/vuln/detail/CVE-2026-92229 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/0m5zbEcjUA
Post summary
The tweet announces CVE-2026-92229, a high-severity arbitrary shortcode execution flaw in Forminator Forms WordPress plugin versions up to 1.57.2, and explicitly advises users to update.
1000046
97 followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters41d
General
CVE-2026-92229 Forminator Forms WordPress plugin, CVSS 9.1. Unauthenticated attackers can run arbitrary shortcodes on all versions up to 1.57.2. No patch yet. Disable the plugin or restrict access now. https://www.valtersit.com/cve/CVE-2026-92229 #CVE #WordPress #infosec #ForminatorFormsContactFormPaymentFormCustomFormBuilder #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet discloses CVE-2026-92229, a CVSS 9.1 WordPress plugin vulnerability enabling unauthenticated arbitrary shortcode execution up to version 1.57.2, and advises disabling the plugin as a workaround since no patch is yet available.
0000041
1.1K followersView on X
Cybersecurity News DE@cybsecuritynews42d
Disclosure
#schwachstellen Kritische WordPress-Lücken in Gravity Forms und Forminator: Zwei CVEs ohne Anmeldung ausnutzbar #cve202684434 #cve202692229 #forminator #gravityforms #rocketgenius #wordpress #wpmudev https://cybersecurity-news.de/wordpress-schwachstellen-gravity-forms-forminator-cve-2026-84434-cve-2026-92229
Post summary
The post announces two critical unauthenticated WordPress plugin vulnerabilities (Gravity Forms, Forminator) with CVE references but provides no PoC, exploit tool, patch, or active-exploitation evidence beyond a linked news article.
0000035
13 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-92229

ThreatWire[verified]@ThreatWire_PoC

A public PoC has been released for CVE-2026-92229, a critical WordPress Forminator vulnerability (CVSS 9.1), affecting versions up to 1.57.2, with users advised to update to 1.57.3 or later.

Rıdvan Yağlı[verified]@ridvanyagliPoC

The tweet announces a critical vulnerability in Forminator with a public PoC, detailing the arbitrary shortcode execution and recommending an upgrade to 1.57.3+.

Ryx[verified]@PadhiyarRushiPoC

The post details CVE-2026-92229, an unauthenticated shortcode injection in Forminator ≤1.57.2 (CVSS 9.1), notes a Python PoC released this week with a GitHub link, and indicates that version 1.57.3 patches the flaw.

dbugs[verified]@ptdbugsPoC

A proof‑of‑concept/exploit has been released for CVE‑2026‑92229, affecting WordPress Forminator Forms (≤ 1.57.2) and enabling unauthenticated arbitrary shortcode execution.

ADK Cyber[verified]@ADKCyberPatch

The tweet announces CVE-2026-92229, a high-severity arbitrary shortcode execution flaw in Forminator Forms WordPress plugin versions up to 1.57.2, and explicitly advises users to update.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersGeneral

The tweet discloses CVE-2026-92229, a CVSS 9.1 WordPress plugin vulnerability enabling unauthenticated arbitrary shortcode execution up to version 1.57.2, and advises disabling the plugin as a workaround since no patch is yet available.

株式会社mgn@mgn_jpnPatch

The tweet discloses a critical vulnerability (CVSS 9.1) in the Forminator Forms WordPress plugin affecting over 600,000 sites and highlights that a fixed version (1.57.3) has been released.

ExploitGrid@exploitgridPatch

The post discloses a critical arbitrary shortcode execution vulnerability in WordPress Forminator (CVE-2026-92229) with CVSS 9.1, affecting versions up to 1.57.2 and fixed in 1.57.3+.