CVE-2026-84744

MediumCVSS 6.5

Published: 28/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Summary

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form. This allows unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

Risk Assessment

An unauthenticated attacker can execute arbitrary shortcodes, potentially leading to information disclosure from non-public posts and attachments. The vulnerability requires no authentication and can be exploited remotely.

Recommendation

Update the WPForms Lite plugin to a version newer than 2.0.2 if a vendor patch is available. Consider limiting registered shortcodes and auditing non-public content.

Other vulnerabilities in WPForms Lite WordPress plugin

CVE-2026-82844Medium
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway. This allows unauthenticated visitors to submit paid forms without paying, and the form's confirmation is delivered and notification emails are sent even though no order exists at the payment provider.

Original NVD description (English source)

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS