Arbitrary Shortcode Execution in Ninja Forms Contact Form Builder Plugin for WordPress
CVE-2026-101326

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Ninja Forms – Contact Form Builder With Calculators, Quizzes, Signatures & Ai Form Builder
Vendor
CVE Published:
31 October 2026

What is CVE-2026-101326?

The Ninja Forms plugin for WordPress is susceptible to arbitrary shortcode execution due to improper validation before running the do_shortcode function. This vulnerability affects all versions up to and including 3.15.5. Authenticated users with subscriber-level access or higher can exploit this flaw if an administrator has used the {wp:user_display_name} merge tag in any Ninja Forms field default value. By changing their display name to include a shortcode string and then visiting a public page where the form is displayed, these users can execute arbitrary shortcode, potentially leading to more extensive site manipulation or data exposure.

Affected Version(s)

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder 0 <= 3.15.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/ninja-forms/ta...
https://plugins.trac.wordpress.org/browser/ninja-forms/ta...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Iron StrongMan
.