CVE-2026-65052 in Ninja Forms Plugin
Summary
by MITRE • 07/21/2026
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Ninja Forms WordPress plugin affects versions 3.14.8 and earlier, presenting a critical improper input validation flaw that enables unauthenticated attackers to manipulate form calculations and payment totals through carefully crafted submissions. This weakness resides in the plugin's handling of ListSelect and ListRadio field types where the system fails to properly validate submitted values against configured options, creating a pathway for arbitrary numeric injection into payment processing logic.
The technical implementation of this vulnerability stems from the get_calc_value() method which operates with insufficient input sanitization and validation mechanisms. When attackers submit form data containing numeric values that do not correspond to any valid option within ListSelect or ListRadio fields, the system's fail-open behavior allows these attacker-controlled values to be processed without proper verification. This represents a classic CWE-20 input validation weakness where the application fails to properly validate or sanitize user-supplied data before incorporating it into calculations.
The operational impact of this vulnerability extends beyond simple form manipulation to serious financial consequences within WordPress environments utilizing Ninja Forms for payment processing. Attackers can manipulate payment amounts to zero, effectively allowing free access to premium content or services, or set arbitrary figures that bypass configured pricing logic entirely. This creates a significant risk for e-commerce sites, subscription services, and any platform relying on accurate form calculations for revenue processing.
The attack vector specifically targets the ajax submit endpoint which processes form submissions without proper authentication requirements, making it accessible to unauthenticated users. This aligns with ATT&CK technique T1213.002 for data manipulation through web applications. The vulnerability enables attackers to bypass administrative controls and pricing configurations, potentially resulting in substantial financial loss for affected organizations while undermining the integrity of payment processing systems.
Mitigation strategies should focus on implementing comprehensive input validation at multiple levels within the Ninja Forms plugin architecture. Organizations must update to versions 3.14.9 or later where this vulnerability has been addressed through proper validation of ListSelect and ListRadio field values against configured options before processing calculations. Additionally, administrators should implement strict access controls for form submission endpoints and consider additional input sanitization measures that validate numeric values against expected ranges and configured option sets to prevent similar vulnerabilities in other custom form processing solutions.