CVE-2026-100155 in Ninja Forms Plugin
Summary
by MITRE • 10/31/2026
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/31/2026
The Ninja Forms plugin for WordPress represents a widely utilized solution for creating contact forms, surveys, and data collection interfaces within the WordPress ecosystem. Its popularity stems from its extensive feature set, which includes calculators, quizzes, signatures, and increasingly, AI-assisted form building capabilities. However, security assessments have identified a critical vulnerability in versions up to and including 3.15.5 that compromises the integrity of this functionality. The core issue lies in how the plugin handles user-supplied input when rendering dynamic content through shortcodes. Specifically, the software fails to adequately validate or sanitize specific values before passing them into the WordPress do_shortcode function. This architectural flaw creates a pathway for arbitrary shortcode execution, allowing attackers to inject and run malicious code snippets that were not intended by the site administrator.
From a technical perspective, this vulnerability is classified as CWE-94 Improper Control of Generation of Code or Script, commonly referred to as Code Injection. The root cause is insufficient input validation within the plugin's processing logic. When an action is triggered that relies on user-provided data, the application directly executes do_shortcode without verifying whether the content constitutes a legitimate shortcode tag defined by WordPress core or other trusted plugins. This lack of strict allow-listing or rigorous sanitization means that any string formatted as a valid shortcode can be executed in the context of the current page load. Because this process occurs on the server side during request handling, it does not require user interaction beyond submitting a crafted HTTP request, making it particularly dangerous for automated exploitation campaigns.
The operational impact of this vulnerability is severe due to its unauthenticated nature. Attackers do not need valid credentials or any form of authentication against the WordPress site to exploit this flaw. By crafting specific requests that include malicious shortcode payloads, an attacker can execute arbitrary PHP code on the server hosting the vulnerable website. This capability effectively leads to Remote Code Execution (RCE), which is categorized under MITRE ATT&CK technique T1059 Command and Scripting Interpreter. Once executed, these shortcodes can perform a wide range of destructive actions, including but not limited to reading sensitive database contents, modifying site configurations, installing backdoors for persistent access, or defacing the website. The ability to execute code with the privileges of the web server process means that an attacker gains full control over the compromised environment, potentially using it as a pivot point to attack other systems within the network infrastructure.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary and most effective solution is to upgrade the Ninja Forms plugin to version 3.15.6 or later, where this validation flaw has been patched by the developers. Site administrators should verify their current installation immediately through the WordPress dashboard or via command line tools if available. In cases where immediate updating is not feasible due to compatibility concerns with other plugins or custom code, temporary mitigations may include restricting access to the site's administrative endpoints using IP whitelisting or Web Application Firewall rules that block requests containing suspicious shortcode patterns. Additionally, implementing strict Content Security Policy headers and ensuring that server-side execution environments are hardened can reduce the blast radius if an exploitation attempt occurs. Regular security audits and monitoring of plugin changelogs are essential practices to maintain resilience against such vulnerabilities in third-party WordPress extensions.