Ninja Forms CVE-2026-65051

The Ninja Forms plugin version 3.14.8 must be installed and active on a WordPress site. No authentication is required - the attack targets the WordPress nopriv AJAX endpoint (wp-admin/admin-ajax.php), which is accessible by design to unauthenticated users. No special configuration is needed beyond having at least one active Ninja Form with configured actions (email notification or database storage). Exploitation is limited in scope: the attacker cannot read data, execute code, or escalate privileges - only inject content into form-triggered actions. Sites that have disabled AJAX-based form submission, placed wp-admin/admin-ajax.php behind authentication at the server level, or use a WAF rule blocking nopriv AJAX abuse would reduce exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L) yields a base score of 6.9, reflecting a network-accessible, zero-complexity, unauthenticated attack with limited but concrete integrity and availability impact. The metrics are internally consistent with the description: no confidentiality impact because the attacker is writing data rather than reading it; low integrity impact because attacker-controlled content reaches email inboxes and databases; low availability impact due to potential for form-spam flooding. No EPSS score was provided, but the zero-authentication and zero-complexity prerequisites suggest a meaningful probability of opportunistic exploitation. The absence of a CISA KEV listing and no reported public POC moderates immediate urgency, but the attack surface is enormous given Ninja Forms' deployment footprint. The primary real-world risk is form spam abuse, phishing-content injection into admin email workflows, and database pollution - not system compromise. This is a genuine moderate-severity issue requiring patching, not a high-CVSS alarm requiring emergency response.

An attacker identifies a WordPress site running Ninja Forms 3.14.8 (easily enumerable via plugin readme.txt or generator meta tags) and constructs a crafted HTTP POST request to wp-admin/admin-ajax.php, including field metadata that overrides the server-loaded form definition - setting required flags to false and removing CAPTCHA field entries. The server merges this attacker-supplied metadata before validation, then executes all configured form actions, delivering attacker-composed email content to site administrators and storing the payload in the WordPress database without any content verification.