Ninja Forms EUVD-2026-112137

Requires Ninja Forms for WordPress prior to 3.15.4 with a form containing at least one Checkbox List, Multi-Select List, Image List, Country, or State field reachable via the unauthenticated nf_ajax_submit endpoint; the attacker submits a crafted spreadsheet formula value (e.g. a payload beginning with =, +, -, or @) that NF_Abstracts_List's fall-through validate() fails to escape. The decisive limiting factor is that the payload is harmless data until an administrator downloads the exported submissions file and opens it in a spreadsheet application that evaluates formulas (UI:A); it never executes on the web server itself. No authentication is needed to plant the payload (PR:N), but realistic impact depends entirely on administrator export behavior and spreadsheet formula-execution settings.

This is a moderate-severity, interaction-dependent issue rather than a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A, base 5.1) tells a consistent story: the initial malicious submission is remote, low-complexity and unauthenticated (the nf_ajax_submit endpoint is public by design), but exploitation only completes through Active user interaction (UI:A) - an administrator must export and open the submissions file. Note the vulnerable-system impacts are all None (VC:N/VI:N/VA:N); the entire C/I/A impact lands on a subsequent system (SC:L/SI:L/SA:L), i.e. the administrator's workstation/spreadsheet, which is exactly what you expect from CWE-1236 CSV formula injection. No EPSS score was provided, there is no CISA KEV listing, and the input shows no confirmed working exploit code - only a VulnCheck advisory reference. The vendor-assigned priority is 'this_month' (not act_now/emergency), which aligns with the picture: a widely deployed plugin (raising exposure) but a limited-impact, interaction-gated flaw. Treat this as a scheduled-patch item that is elevated by the product's large install base rather than by any evidence of mass exploitation.

An unauthenticated attacker submits a Ninja Forms entry through the public nf_ajax_submit endpoint, placing a spreadsheet formula payload into a Checkbox List, Multi-Select List, Image List, Country, or State field, which skips the CSV escaping applied only to Textbox/Textarea fields. The payload sits inert in the stored submissions until a site administrator exports the entries and opens the resulting CSV in a spreadsheet application, at which point the formula executes in the admin's context. No public exploit identified at time of analysis; a VulnCheck advisory reference exists but is not verified as working exploit code.