# CVE-2026-19857: Formidable Forms unauthenticated arbitrary shortcode execution

Source: https://junglewise.ai/threats/cve-2026-19857-formidable-forms-unauthenticated-arbitrary-shortcode-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19857 · Severity: medium · CVSS 4.8 · Published 2026-09-16

Formidable Forms, a popular WordPress plugin for creating dynamic forms, contains a vulnerability that allows unauthenticated attackers to execute arbitrary code on affected websites. By injecting malicious shortcodes through the [entry_key] token in custom form HTML, an attacker can achieve remote code execution on any page displaying a vulnerable form. This could lead to complete compromise of the website, theft of sensitive data, or installation of malware.

Technologies: [Formidable Forms](https://junglewise.ai/threats/technologies/formidable-forms). Vendors: [Formidable](https://junglewise.ai/threats/vendors/formidable).

## Quick answers

**Is CVE-2026-19857 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19857 being exploited in the wild.

**How severe is CVE-2026-19857?** Medium severity, with a CVSS score of 4.8, published 16 September 2026.

**Which products and versions are affected?** Formidable Forms before 6.35.

**Is there a fix for CVE-2026-19857?** A patch was published on 2026-09-14: Fixed in version 6.35 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19857 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19857?** Check whether you run Formidable Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side injection flaw in the Formidable Forms plugin's token substitution mechanism. When the plugin substitutes the [entry_key] token into custom HTML blocks, it fails to sanitize request-derived values before passing them to the WordPress shortcode parser. This allows an unauthenticated attacker to inject arbitrary shortcodes with attacker-controlled attributes, resulting in server-side code execution. Exploitation requires that the site owner has explicitly configured the form to include the [entry_key] token in custom HTML; this token is documented and supported but not present in default form configurations. The attack is network-accessible and requires no authentication or user interaction beyond a normal page visit.

## Affected products

- Formidable Formidable Forms before 6.35

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 6.35

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/5ff439f4-aa99-4198-b908-0cf098656cf7/](https://wpscan.com/vulnerability/5ff439f4-aa99-4198-b908-0cf098656cf7/)

## Related threats

- [Formidable Forms arbitrary plugin installation vulnerability](https://junglewise.ai/threats/cve-2026-89435-the-formidable-forms-wordpress-form-builder-for-contact-forms)
- [Formidable Forms unauthenticated payment gateway rate limit bypass](https://junglewise.ai/threats/cve-2026-85642-the-formidable-forms-wordpress-plugin-before-7-0-does-not-verify)
- [Formidable Forms Stored Cross-Site Scripting via frm_user_id parameter](https://junglewise.ai/threats/cve-2026-18331-formidable-forms-stored-cross-site-scripting-via-frm-user-id)