Ninja Forms CVE-2026-100155

No authentication is required (PR:N) and the flaw is reachable by unauthenticated attackers over the network against default installations of the Ninja Forms WordPress plugin in all versions up to and including 3.15.5. The specific trigger is an action (associated in the referenced source with the SuccessMessage action and the AJAX submission controller) that passes a value to do_shortcode without properly validating it; the precise field controlling that value is not fully described in the available sources beyond the cited code locations. The practical limiting factor is that impact is bounded by which shortcodes are registered on the target site - arbitrary shortcode execution only yields meaningful compromise if powerful or dangerous shortcodes are available, which is why CVSS caps confidentiality and integrity at Low and availability at None.

This is a moderate-severity issue that warrants timely but not emergency remediation. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw requiring no authentication, no user interaction, and low attack complexity - the most favorable conditions for an attacker - but impact is capped at Low confidentiality and Low integrity with no availability impact, which keeps the score out of the high/critical range. The vuln.today decision label is 'this_month', consistent with a prioritized-but-not-urgent posture. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The vulnerability is NOT on the CISA KEV list and there is no confirmed public exploit: the provided references are the Wordfence advisory, WordPress.org plugin pages, and plugins.trac source-code/changeset links showing the affected code paths and the fix - these are code-location citations, not working exploit code. The real risk driver here is prevalence rather than raw severity: Ninja Forms is a very widely installed plugin, so an unauthenticated flaw affecting default installations is attractive for opportunistic, automated scanning. The practical ceiling on impact is that 'arbitrary shortcode execution' is bounded by which shortcodes are actually registered on a given site; severity therefore varies per-deployment and the CVSS Low/Low impact reflects this uncertainty.

An unauthenticated attacker submits a crafted request to a public Ninja Forms submission endpoint containing input that is later passed to do_shortcode without proper validation, causing the plugin to execute attacker-chosen shortcodes server-side. Because no authentication or user interaction is required (PR:N/UI:N) and attack complexity is low, this can be automated against any site running an affected version. No confirmed working exploit code was identified in the provided sources; the actual damage depends on which shortcodes are available on the target site.