CVE-2026-67187 | BDVDB-2026-396842 Detail

Description#

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-28Record published in the CVE List.
2. Version 22026-11-03Most recent update recorded in the CVE List.