Medium severity · published Sep 28, 2026
CVE-2026-84744
WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
WPForms ·
1.5.0.1 before 2.0.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-84744
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-84744
exploit
https://wpscan.com/vulnerability/99c4a9fc-114e-4d39-80aa-0e9544125794/
More from WPForms
6.8
CVE-2026-74991
WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent
5.3
CVE-2026-4986
WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery
4.7
CVE-2024-11223
WPForms < 1.9.2.3 - Admin+ Stored XSS
3.5
CVE-2024-7056
WPForms < 1.9.1.6 - Admin+ Stored XSS