What is GHSA-7fm6-hmq5-pxwv?

GHSA-7fm6-hmq5-pxwv is a security advisory published by GitHub Security Advisories with Medium severity. The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from...

Which CVE IDs does GHSA-7fm6-hmq5-pxwv cover?

GHSA-7fm6-hmq5-pxwv covers the following CVE IDs: CVE-2026-84744. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7fm6-hmq5-pxwv?

GHSA-7fm6-hmq5-pxwv has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-7fm6-hmq5-pxwvMediumCVSS 6.5

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from...

Vendor

GitHub Security Advisories

Published

September 28, 2026

Last Modified

September 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-84744 →

📋 Description

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84744
https://wpscan.com/vulnerability/99c4a9fc-114e-4d39-80aa-0e9544125794
https://github.com/advisories/GHSA-7fm6-hmq5-pxwv