CVE-2026-84744

MediumCVSS 6.5/10Last modified Sep 28, 2026

Description

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Sep 28, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-847452.7The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public RES CVE-2026-84747Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to by CVE-2026-84748Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the pu CVE-2026-847506.5The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of CVE-2026-847528.8Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.CVE-2026-847539.8Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.CVE-2026-847546.5Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.CVE-2026-847556.5Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.CVE-2026-847567.1Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.CVE-2026-847578.2Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.CVE-2026-847586.5Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.CVE-2026-847597.1Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.