Is CVE-2026-84744 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84744?

CVE-2026-84744 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-84744

Description

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.