CVE-2026-15663 in Ninja Forms Plugin
Summary
by MITRE • 07/24/2026
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the 'settings' object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability resides within the Ninja Forms WordPress plugin, specifically affecting versions through 3.14.9, where a generic SQL injection flaw exists due to inadequate input sanitization and query preparation practices. The vulnerability stems from insufficient escaping of user-supplied parameters within the import file processing functionality, creating a pathway for authenticated attackers with administrator-level privileges to manipulate database queries through maliciously crafted import files. The exploitation occurs when the plugin processes settings objects from attacker-controlled import files using file_get_contents() or base64-decoded/JSON-decoded data structures, effectively bypassing WordPress's wp_magic_quotes protections entirely.
The technical implementation flaw manifests in two distinct code paths within the plugin's architecture, specifically affecting the _save_setting() method in Model.php and the insert_form_meta() function in ImportForm.php. These functions process user-supplied data without proper parameterization or sanitization of the key components of the settings object, while only the value portions receive escaping. This asymmetric handling creates a predictable injection point where maliciously constructed keys can be used to append additional SQL operations to existing queries. The vulnerability operates at the database layer, allowing attackers to extract sensitive information from the WordPress database through crafted SQL injection payloads that leverage the improperly sanitized key elements.
The operational impact of this vulnerability is significant for WordPress installations using the affected Ninja Forms plugin, as it provides authenticated attackers with a direct pathway to database enumeration and potential data exfiltration. Attackers with administrator-level access can exploit this weakness to retrieve user credentials, configuration details, and other sensitive data stored within the WordPress database. This represents a critical security risk since the vulnerability requires only administrative privileges to exploit, making it particularly dangerous in environments where administrators may have elevated access rights or where privilege escalation attacks could be facilitated through this vector.
Mitigation strategies should focus on immediate patching of the plugin to versions that properly sanitize both key and value components of imported settings objects. Administrators should also implement additional security measures including restricting file upload capabilities, monitoring for unusual import activities, and ensuring proper input validation at all levels of data processing. The vulnerability aligns with CWE-89 which defines SQL injection as a critical weakness in software applications, and follows ATT&CK technique T1078 for valid accounts and T1566 for credential access through exploitation of application vulnerabilities. Organizations should also consider implementing database activity monitoring to detect anomalous SQL query patterns that may indicate exploitation attempts, while maintaining current threat intelligence feeds to stay informed about related attack vectors targeting WordPress plugins.