Quick answers
- Is CVE-2026-19857 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19857 being exploited in the wild.
- How severe is CVE-2026-19857?
- Medium severity, with a CVSS score of 4.8, published 16 September 2026.
- Which products and versions are affected?
- Formidable Forms before 6.35.
- Is there a fix for CVE-2026-19857?
- A patch was published on 2026-09-14: Fixed in version 6.35 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19857 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-19857?
- Check whether you run Formidable Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a server-side injection flaw in the Formidable Forms plugin's token substitution mechanism. When the plugin substitutes the [entry_key] token into custom HTML blocks, it fails to sanitize request-derived values before passing them to the WordPress shortcode parser. This allows an unauthenticated attacker to inject arbitrary shortcodes with attacker-controlled attributes, resulting in server-side code execution. Exploitation requires that the site owner has explicitly configured the form to include the [entry_key] token in custom HTML; this token is documented and supported but not present in default form configurations. The attack is network-accessible and requires no authentication or user interaction beyond a normal page visit.
Affected products
- Formidable Formidable Forms before 6.35
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 6.35