Shortcode Injection Flaw in Ninja Forms Plugin by WordPress
CVE-2026-15256

4.8MEDIUM

Key Information:

Vendor

WordPress
Status
Ninja Forms
Vendor
CVE Published:
6 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15256?

The Ninja Forms plugin for WordPress allows unauthenticated adversaries to exploit a vulnerability that arises when user-supplied query-string input is not adequately sanitized. This flaw enables attackers to input data into a form field that bypasses validation, processing it as a shortcode. When a form with this configuration is displayed on a public page, it permits the execution of arbitrary shortcodes registered on the site. As a result, this could lead to unauthorized actions being performed within the WordPress environment, posing significant risks to site integrity and user data security.

Affected Version(s)

Ninja Forms 0 < 3.14.10

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15256 - Proof of Concept

References

https://wpscan.com/vulnerability/9c96f977-c105-4b45-a3cd-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Meher Sudhakar Abbireddi
WPScan
.