Ninja Forms EUVD-2026-114572

Exploitation is NOT possible against a default install. It requires all of: (1) an administrator has created at least one Ninja Forms field whose Default Value is set to the {wp:user_display_name} merge tag; (2) that form/field is rendered on a publicly accessible page; and (3) the attacker holds at least Subscriber-level authentication to set their profile display_name to a shortcode string. The impact is further bounded by which shortcodes are actually registered on the target site. Limiting factors: authenticated Subscriber access is needed (PR:L), the specific non-default merge-tag configuration must be present, and no victim/admin interaction is required beyond the attacker visiting the page themselves - so the gating factor is the configuration, not user interaction.

This is a moderate-severity, low-urgency issue rather than a true emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4) reflects authenticated (PR:L) network access with only Low confidentiality and integrity impact and no availability impact, which is consistent with abuse of do_shortcode rather than direct remote code execution. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the input, so there is no signal of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis' (only a Wordfence threat-intel reference and WordPress trac source/changeset links are provided, none of which is verified working exploit code). The most important caveat is that the supplied AC:L understates the real difficulty: exploitation is gated by a specific, non-default administrator configuration (a Ninja Forms field whose Default Value is the {wp:user_display_name} merge tag, rendered on a public page), so real-world exposure is much narrower than a 5.4 network-vector score suggests. Net: a real but conditional privilege/trust-boundary flaw that should be patched on a normal cycle, not treated as an under-attack critical.

An administrator has configured a public Ninja Forms field with its Default Value set to the {wp:user_display_name} merge tag. A low-privileged Subscriber edits their profile to set their display name to a shortcode string, then simply loads that public page; when the merge tag renders, the plugin passes the attacker-controlled display name through do_shortcode, executing whatever shortcode the attacker supplied with the capabilities of whatever shortcodes the site has registered. No public exploit code is identified at time of analysis, only a vendor (Wordfence) advisory and WordPress trac source references.