Executive brief
Formidable Forms, a popular WordPress plugin for creating dynamic forms, contains a vulnerability that allows unauthenticated attackers to execute arbitrary code on affected websites. By injecting malicious shortcodes through the [entry_key] token in custom form HTML, an attacker can achieve remote code execution on any page displaying a vulnerable form. This could lead to complete compromise of the website, theft of sensitive data, or installation of malware.
Technical details
The vulnerability is a server-side injection flaw in the Formidable Forms plugin's token substitution mechanism. When the plugin substitutes the [entry_key] token into custom HTML blocks, it fails to sanitize request-derived values before passing them to the WordPress shortcode parser. This allows an unauthenticated attacker to inject arbitrary shortcodes with attacker-controlled attributes, resulting in server-side code execution. Exploitation requires that the site owner has explicitly configured the form to include the [entry_key] token in custom HTML; this token is documented and supported but not present in default form configurations. The attack is network-accessible and requires no authentication or user interaction beyond a normal page visit.
Affected products
- Formidable Formidable Forms before 6.35
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 6.35