Vulnerability in Ninja Forms – The Contact Form Builder That Grows With You — CVE-2026-67187
What to do now
Update Ninja Forms – The Contact Form Builder That Grows With You to 3.15.4 or later.
Affected versions
- Everything before 3.15.4
Affected: Ninja Forms – The Contact Form Builder That Grows With You (plugin, ninja-forms)
What the vulnerability is
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.