Ninja Forms EUVD-2026-46272

Exploitation requires a target site running Ninja Forms 3.14.8 or earlier with a form that uses a ListSelect or ListRadio field wired into calculation or payment-total logic; the attacker submits a value that does not match any admin-configured option to the plugin's AJAX submit endpoint, triggering the fail-open behavior in get_calc_value(). No authentication is required (PR:N), no user interaction is needed (UI:N), and it is remotely reachable (AV:N) against affected versions. The practical limiting factor is configuration-dependent: sites that do not use ListSelect/ListRadio fields for pricing or payment calculations have no meaningful financial impact, so the condition is 'a payment or calculation form built with these specific field types must exist,' not merely network reachability.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) scores 8.7 and cleanly matches the description: network-reachable, low-complexity, unauthenticated, no user interaction, with a high integrity impact and no confidentiality or availability impact - consistent with a business-logic/pricing tampering flaw rather than code execution or data disclosure. No EPSS score was provided, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' This is a genuine priority for any site that uses Ninja Forms to collect payments or price-sensitive submissions, because exploitation is trivial and directly monetizable (zero-cost checkouts), but the real-world blast radius is bounded to sites actually using payment/calculation logic - informational or contact-only forms are not financially impacted. Note that impact is scoped to integrity of submissions/pricing; there is no direct server compromise or data theft implied by the vector or description.

An attacker opens a page hosting a Ninja Forms payment form that uses a ListSelect or ListRadio field, then intercepts and modifies the form submission sent to the AJAX submit endpoint, replacing the field's calc value with one that matches no configured option (for example, a total of 0). Because get_calc_value() fails open and returns the attacker-supplied number, the order or payment total is computed from the tampered value, letting the attacker check out for free or at an arbitrary price. No authentication, user interaction, or special tooling beyond an intercepting proxy is required; no public POC is identified at this time.