SQL Injection Vulnerability in Ninja Forms Contact Form Builder Plugin for WordPress

CVE-2026-15663

What is CVE-2026-15663?

The Ninja Forms Contact Form Builder plugin for WordPress is susceptible to SQL injection attacks through the Import File 'settings' key, affecting all versions up to 3.14.9. This vulnerability arises from inadequate escaping of user-supplied parameters and poor preparation of existing SQL queries. Authenticated attackers with administrator-level access can exploit this flaw by appending additional SQL queries, potentially leading to exposure of sensitive database information. The issue is rooted in the handling of settings from attacker-controlled import files, allowing a bypass of standard protections. Key functions, such as _save_setting() and insert_form_meta(), fail to adequately sanitize their inputs, posing a significant risk to user data.

References