Skip to main content

Ninja Forms EUVDEUVD-2026-46272

| CVE-2026-65052 HIGH
External Control of Assumed-Immutable Web Parameter (CWE-472)
2026-07-21 VulnCheck GHSA-w952-x9hc-f66c
WordPress Authentication Bypass Ninja Forms
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Remote, low-complexity, unauthenticated tampering of pricing data with no user interaction gives AV:N/AC:L/PR:N/UI:N; only integrity is affected (I:H), so C and A are N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 15:04 vuln.today
CVE Published
Jul 21, 2026 - 14:36 cve.org
HIGH 8.7

DescriptionCVE.org

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026

AnalysisAI

Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Load page with Ninja Forms payment form
Delivery
Intercept AJAX form submission
Exploit
Inject non-matching calc value in ListSelect/ListRadio field
Execution
get_calc_value() fails open, returns attacker value
Persist
Submit tampered payment total (e.g. zero)
Impact
Bypass configured pricing, complete transaction
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a target site running Ninja Forms 3.14.8 or earlier with a form that uses a ListSelect or ListRadio field wired into calculation or payment-total logic; the attacker submits a value that does not match any admin-configured option to the plugin's AJAX submit endpoint, triggering the fail-open behavior in get_calc_value(). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) scores 8.7 and cleanly matches the description: network-reachable, low-complexity, unauthenticated, no user interaction, with a high integrity impact and no confidentiality or availability impact - consistent with a business-logic/pricing tampering flaw rather than code execution or data disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker opens a page hosting a Ninja Forms payment form that uses a ListSelect or ListRadio field, then intercepts and modifies the form submission sent to the AJAX submit endpoint, replacing the field's calc value with one that matches no configured option (for example, a total of 0). Because get_calc_value() fails open and returns the attacker-supplied number, the order or payment total is computed from the tampered value, letting the attacker check out for free or at an arbitrary price. …
Remediation Patch available per vendor advisory: upgrade Ninja Forms to the latest fixed release above 3.14.8 as published in the plugin changelog at https://wordpress.org/plugins/ninja-forms/changelog/ (an exact fixed version number is not stated in the provided data, so confirm the patched version in the changelog before deploying). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all WordPress installations to identify Ninja Forms versions 3.14.8 or earlier, prioritizing those processing payments. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ninja Forms

View all
CVE-2016-1209 CRITICAL POC
9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
CVE-2021-24163 HIGH POC
8.8 Apr 05

The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it ha
CVE-2018-16308 HIGH POC
8.6 Sep 01

The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. Rated high severity (CVSS 8.6), this vulnerab
CVE-2022-2903 HIGH POC
7.2 Sep 26

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could le
CVE-2021-24889 HIGH POC
7.2 Nov 29

The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which coul
CVE-2021-34647 MEDIUM POC
6.5 Sep 22

The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions funct
CVE-2024-7354 MEDIUM POC
6.1 Sep 02

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading
CVE-2023-37979 MEDIUM POC
6.1 Jul 27

Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
CVE-2023-1835 MEDIUM POC
6.1 May 15

The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it bac
CVE-2021-24165 MEDIUM POC
6.1 Apr 05

In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable

CVE-2018-19796 MEDIUM POC
6.1 Dec 03

An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via

CVE-2018-19287 MEDIUM POC
6.1 Nov 15

XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes

Same weakness CWE-472 – External Control of Assumed-Immutable Web Parameter

View all
CVE-2025-35939 MEDIUM
6.9
CVE-2017-5260 HIGH POC
8.8
CVE-2017-5261 HIGH POC
8.8
CVE-2024-7025 HIGH POC
8.8
CVE-2025-43933 CRITICAL
9.8
CVE-2025-43930 CRITICAL
9.8
CVE-2024-25153 CRITICAL
9.8
CVE-2021-1295 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

EUVD-2026-46272 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy