Incomplete Server-Side Validation in Ninja Forms Plugin for WordPress

CVE-2026-67187

What is CVE-2026-67187?

The Ninja Forms plugin for WordPress, prior to version 3.15.4, is susceptible to a server-side validation issue, which allows unauthenticated users to submit arbitrary data via specific fields such as Checkbox List, Multi-Select List, Image List, Country, and State. This vulnerability stems from a flaw in the NF_Abstracts_List that improperly validates user input by only checking for the required fields. As a result, attackers can exploit this weakness to submit carefully crafted payloads through the nf_ajax_submit endpoint, leading to potential CSV injection exploits when administrators export and view submission files.

References