CVE-2026-67187— Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

Quick assessment

Affected

Saturday Drive Ninja Forms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Ninja Forms 插件在 3.15.4 版本之前存在一个不完整的服务器端验证漏洞。该漏洞允许未认证的攻击者向复选框列表、多选列表、图片列表、国家字段和州/省字段提交任意值，原因是类会落入仅检查必填字段是否存在的方法。攻击者可通过未认证的接口提交精心构造的公式载荷，从而绕过仅应用于文本框（Textbox）和文本域（Textarea）字段的 CSV 转义处理，最终导致管理员下载并打开导出的提交数据文件时发生 CSV 注入攻击。

CVSS 7.1 · High EPSS 0.17% · P7 Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1566.002 · Spearphishing Link T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Saturday Drive	Ninja Forms	`< 3.15.4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

Source: CVE Program / CVE List V5

Vulnerability Description

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1236

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Saturday Drive	Ninja Forms	0 ~ 3.15.4	-

II. Public POCs for CVE-2026-67187

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-67187

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-67187 (1)

🔗 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-67187

IV. Related Vulnerabilities

Same product: Ninja Forms

Same vendor: Saturday Drive

Same weakness: CWE-1236