Which versions of Ninja Forms are affected by CVE-2026-65052?

Ninja Forms WordPress plugin versions 3.14.8 and earlier contain an unauthenticated payment-tampering vulnerability allowing attackers to manipulate order totals to zero or arbitrary values, creating…. A patch is available.

How to fix or mitigate CVE-2026-65052?

Within 24 hours, audit all WordPress installations to identify Ninja Forms versions 3.14.8 or earlier, prioritizing those processing payments. Within 7 days, apply vendor-provided patches to update all affected Ninja Forms installations to the latest available version. Within 30 days, verify patching completion across all environments, audit transaction logs from the past 30 days for payment anomalies including zero-value orders and unexplained discounts, and implement logging to detect future payment-total manipulation attempts.

Ninja Forms CVE-2026-65052

Q: What is the CVSS score of CVE-2026-65052?

CVE-2026-65052 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46272 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-07-21 VulnCheck

GHSA-w952-x9hc-f66c

WordPress Authentication Bypass Ninja Forms Wordpress Plugin Saturday Drive

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated tampering of pricing data with no user interaction gives AV:N/AC:L/PR:N/UI:N; only integrity is affected (I:H), so C and A are N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 15:04 vuln.today

CVE Published

Jul 21, 2026 - 14:36 cve.org

HIGH 8.7

DescriptionCVE.org

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026

AnalysisAI

Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.

Technical ContextAI

Ninja Forms is a drag-and-drop form builder for WordPress that supports calculation fields and e-commerce/payment integrations, where field selections drive computed totals. The affected components are the ListSelect and ListRadio field types, whose server-side get_calc_value() routine is intended to map a submitted selection back to its admin-configured numeric value. The root cause is CWE-472 (External Control of Assumed-Immutable Web Parameter): the AJAX submit endpoint trusts the client-supplied calc value rather than strictly validating it against the server-side list of allowed options, so an unrecognized value is accepted ('fails open') instead of being rejected or coerced to a safe default. The affected package is identified by CPE cpe:2.3:a:saturday_drive:ninja_forms (vendor Saturday Drive).

RemediationAI

Patch available per vendor advisory: upgrade Ninja Forms to the latest fixed release above 3.14.8 as published in the plugin changelog at https://wordpress.org/plugins/ninja-forms/changelog/ (an exact fixed version number is not stated in the provided data, so confirm the patched version in the changelog before deploying). Until patched, reduce exposure by disabling or removing calculation and payment functionality that depends on ListSelect and ListRadio fields, or replace those field types with server-validated alternatives where option-to-value mapping is enforced - accepting the trade-off of reduced form flexibility. As compensating controls, add server-side/back-office verification of order totals against expected pricing before fulfilling any transaction and reconcile payment amounts with the payment processor's records to catch zeroed or altered totals, and consider a WAF rule to inspect submissions to the Ninja Forms AJAX submit endpoint for calc values that do not correspond to configured options. Full remediation details are in the VulnCheck advisory linked above.