BitFire blocks automated Forminator exploit delivery, while PRO RASP stops privileged actions invoked through malicious shortcodes.
library/abstracts/abstract-class-front-action.php: get_post_data(); library/modules/quizzes/front/front-action.php: submit_quizzes() and render_knowledge_result()CVE-2026-92229 is a critical unauthenticated arbitrary shortcode execution vulnerability in Forminator Forms through version 1.57.2. A public Knowledge quiz accepts shortcode syntax in the visitor-controlled `current_url`, embeds it in HTML, and runs `do_shortcode()` across the completed buffer. The result is server-side execution of any registered shortcode, with impact determined by its handler. BitFire FREE Bot Protection blocks automated exploit POSTs and unverified browsers before WordPress processes them. If a request reaches PHP, BitFire PRO RASP stops unauthorized PHP writes, plugin installation, administrator creation, and administrator impersonation attempted through the shortcode.
The affected component, attack path, and practical risk for WordPress websites.
BitFire blocks automated exploit delivery before Forminator runs and denies unauthorized privileged actions if a malicious shortcode reaches runtime.
Research details, affected versions, exploitation behavior, and remediation guidance.
The exploit targets `/wp-admin/admin-ajax.php` and requires a public Knowledge quiz whose questions are all answered. Forminator's public endpoint supplies the nonce, so that check does not establish a WordPress identity. Version 1.57.2 accepts `current_url`, places it in a social-sharing `data-url` attribute, and escapes it with `esc_url()`. Square brackets remain valid URL characters, so injected shortcode syntax survives. The renderer then sends the entire HTML buffer through `do_shortcode()`, invokes the registered handler, and returns its output in `finalText`. This is arbitrary shortcode execution rather than automatic PHP execution; the final impact depends on the shortcodes registered by the site's plugins and theme.
BitFire FREE Bot Protection blocks known attack tools, unknown automated clients, and browsers that have not passed JavaScript verification from submitting the malicious quiz POST. The request is rejected before WordPress dispatches it to Forminator, so the vulnerable renderer never receives the injected `current_url`. Legitimate integrations can be narrowly allowed without disabling other protections. This vulnerability does not require a standard SQL injection, XSS, traversal, or malicious-file payload, so the protection claim does not depend on a WAF signature: Bot Protection stops the automated delivery path itself.
BitFire PRO RASP enforces authorization when WordPress and PHP attempt a protected operation. If an injected shortcode tries to install a plugin or create or modify PHP, filesystem protection denies the unauthorized write before a web shell or backdoor reaches disk. Database protection blocks administrator creation or privilege promotion without administrator authority. Login protection rejects administrator impersonation and authentication-cookie creation when the request lacks valid WordPress credentials. RASP does not sanitize `current_url` or suppress harmless shortcode output; it stops the privileged actions that turn shortcode execution into persistent code or account takeover.
Forminator 1.57.2.1 breaks the exploit twice: it normalizes `current_url` and removes shortcode syntax at the shared input boundary, then processes only trusted administrator-authored text before assembling the result buffer. Update immediately. Patching does not remove an earlier compromise, so sites that exposed a Knowledge quiz on a vulnerable release should investigate before declaring themselves clean. BitFire Threat Hunter can uncover backdoor administrator accounts, hidden database triggers, long-running PHP processes, and droppers that restore malware. Preserve logs, remove discovered persistence, and rotate relevant credentials.
BitFire FREE blocks the automated POST before vulnerable Forminator code runs, while BitFire PRO RASP denies unauthorized PHP, plugin, and administrator operations at runtime. Threat Hunter adds the persistence investigation needed after possible exposure. Deploy BitFire, update Forminator to 1.57.2.1 or later, and inspect affected sites for prior compromise. These controls deliver decisive defense before, during, and after exploitation without treating firewall protection as a substitute for patching.
The relevant source is located in library/abstracts/abstract-class-front-action.php: get_post_data(); library/modules/quizzes/front/front-action.php: submit_quizzes() and render_knowledge_result().
// Vulnerable behavior in Forminator 1.57.2, abridged.
$post_data = $this->remove_uploads_uid( $post_data );
return $post_data; // current_url retains shortcode syntax.
data-url="<?php echo esc_url( self::$prepared_data['current_url'] ); ?>"
$knowledge_result_html = ob_get_clean();
$knowledge_result_html = do_shortcode( $knowledge_result_html );// Corrected behavior in Forminator 1.57.2.1, abridged.
$post_data = $this->remove_uploads_uid( $post_data );
$post_data = self::sanitize_post_current_url( $post_data );
protected static function sanitize_post_current_url( $post_data ) {
if ( empty( $post_data['current_url'] ) ) {
return $post_data;
}
$current_url = esc_url_raw( wp_unslash( $post_data['current_url'] ) );
$post_data['current_url'] = strip_shortcodes( $current_url );
return $post_data;
}
// Process only trusted text as shortcode input.
echo wp_kses_post( wpautop( do_shortcode( $text ), true ) );
$knowledge_result_html = ob_get_clean();BitFire protects WordPress servers on day zero—before a vulnerability is publicly known and before other vendors have time to develop signatures or patches.
Bot controls and browser verification stop untrusted automated clients before previously unknown exploit code reaches WordPress.
General WAF protections identify dangerous request behavior and hostile payloads without waiting for a vulnerability-specific signature.
RASP follows execution inside PHP and prevents unauthorized changes to protected files, accounts, and database content.
BitFire combines bot controls, request inspection, malware detection, and runtime protection in one WordPress security platform.