CVE-2026-67187
CVE-2026-67187 · Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.
CVSS 5.1 · Moyenne · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
ninja forms
- Versions du logiciel
- ≥ 0, < 3.15.4: Concernée (semver)
Mettez à jour vers 3.15.4