BitFire blocks automated Forminator exploit delivery, while PRO RASP stops privileged actions invoked through malicious shortcodes.
library/abstracts/abstract-class-front-action.php: get_post_data(); library/modules/quizzes/front/front-action.php: submit_quizzes() and render_knowledge_result()CVE-2026-92229 is a critical unauthenticated arbitrary shortcode execution vulnerability in Forminator Forms through version 1.57.2. A public Knowledge quiz accepts shortcode syntax in the visitor-controlled `current_url`, embeds it in HTML, and runs `do_shortcode()` across the completed buffer. The result is server-side execution of any registered shortcode, with impact determined by its handler. BitFire FREE Bot Protection blocks automated exploit POSTs and unverified browsers before WordPress processes them. If a request reaches PHP, BitFire PRO RASP stops unauthorized PHP writes, plugin installation, administrator creation, and administrator impersonation attempted through the shortcode.
Le composant concerné, le chemin d’attaque et le risque pratique pour les sites Web WordPress.
BitFire blocks automated exploit delivery before Forminator runs and denies unauthorized privileged actions if a malicious shortcode reaches runtime.
Détails de la recherche, versions concernées, comportement d'exploitation et conseils de remédiation.
The exploit targets `/wp-admin/admin-ajax.php` and requires a public Knowledge quiz whose questions are all answered. Forminator's public endpoint supplies the nonce, so that check does not establish a WordPress identity. Version 1.57.2 accepts `current_url`, places it in a social-sharing `data-url` attribute, and escapes it with `esc_url()`. Square brackets remain valid URL characters, so injected shortcode syntax survives. The renderer then sends the entire HTML buffer through `do_shortcode()`, invokes the registered handler, and returns its output in `finalText`. This is arbitrary shortcode execution rather than automatic PHP execution; the final impact depends on the shortcodes registered by the site's plugins and theme.
BitFire FREE Bot Protection blocks known attack tools, unknown automated clients, and browsers that have not passed JavaScript verification from submitting the malicious quiz POST. The request is rejected before WordPress dispatches it to Forminator, so the vulnerable renderer never receives the injected `current_url`. Legitimate integrations can be narrowly allowed without disabling other protections. This vulnerability does not require a standard SQL injection, XSS, traversal, or malicious-file payload, so the protection claim does not depend on a WAF signature: Bot Protection stops the automated delivery path itself.
BitFire PRO RASP enforces authorization when WordPress and PHP attempt a protected operation. If an injected shortcode tries to install a plugin or create or modify PHP, filesystem protection denies the unauthorized write before a web shell or backdoor reaches disk. Database protection blocks administrator creation or privilege promotion without administrator authority. Login protection rejects administrator impersonation and authentication-cookie creation when the request lacks valid WordPress credentials. RASP does not sanitize `current_url` or suppress harmless shortcode output; it stops the privileged actions that turn shortcode execution into persistent code or account takeover.
Forminator 1.57.2.1 breaks the exploit twice: it normalizes `current_url` and removes shortcode syntax at the shared input boundary, then processes only trusted administrator-authored text before assembling the result buffer. Update immediately. Patching does not remove an earlier compromise, so sites that exposed a Knowledge quiz on a vulnerable release should investigate before declaring themselves clean. BitFire Threat Hunter can uncover backdoor administrator accounts, hidden database triggers, long-running PHP processes, and droppers that restore malware. Preserve logs, remove discovered persistence, and rotate relevant credentials.
BitFire FREE blocks the automated POST before vulnerable Forminator code runs, while BitFire PRO RASP denies unauthorized PHP, plugin, and administrator operations at runtime. Threat Hunter adds the persistence investigation needed after possible exposure. Deploy BitFire, update Forminator to 1.57.2.1 or later, and inspect affected sites for prior compromise. These controls deliver decisive defense before, during, and after exploitation without treating firewall protection as a substitute for patching.
La source pertinente se trouve dans library/abstracts/abstract-class-front-action.php: get_post_data(); library/modules/quizzes/front/front-action.php: submit_quizzes() and render_knowledge_result().
// Vulnerable behavior in Forminator 1.57.2, abridged.
$post_data = $this->remove_uploads_uid( $post_data );
return $post_data; // current_url retains shortcode syntax.
data-url="<?php echo esc_url( self::$prepared_data['current_url'] ); ?>"
$knowledge_result_html = ob_get_clean();
$knowledge_result_html = do_shortcode( $knowledge_result_html );// Corrected behavior in Forminator 1.57.2.1, abridged.
$post_data = $this->remove_uploads_uid( $post_data );
$post_data = self::sanitize_post_current_url( $post_data );
protected static function sanitize_post_current_url( $post_data ) {
if ( empty( $post_data['current_url'] ) ) {
return $post_data;
}
$current_url = esc_url_raw( wp_unslash( $post_data['current_url'] ) );
$post_data['current_url'] = strip_shortcodes( $current_url );
return $post_data;
}
// Process only trusted text as shortcode input.
echo wp_kses_post( wpautop( do_shortcode( $text ), true ) );
$knowledge_result_html = ob_get_clean();BitFire protège les serveurs WordPress dès le premier jour, avant qu'une vulnérabilité ne soit connue publiquement et avant que d'autres fournisseurs n'aient le temps de développer des signatures ou des correctifs.
Les contrôles des robots et la vérification du navigateur arrêtent les clients automatisés non fiables avant qu’un code d’exploitation jusqu’alors inconnu n’atteigne WordPress.
Les protections générales WAF identifient les comportements de requêtes dangereux et les charges utiles hostiles sans attendre une signature spécifique à la vulnérabilité.
RASP suit l'exécution dans PHP et empêche les modifications non autorisées des fichiers, comptes et contenus de bases de données protégés.
BitFire combine les contrôles de robots, l'inspection des demandes, la détection des logiciels malveillants et la protection d'exécution dans une seule plateforme de sécurité WordPress.