CVE-2026-67187 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-67187?
CVE-2026-67187 is a medium-severity vulnerability in Saturday Drive Ninja Forms, published on 28 Oct 2026.
Official description
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.
Weakness: CWE-1236
Which versions are affected by CVE-2026-67187?
How do I fix CVE-2026-67187?
No fix has been published for CVE-2026-67187 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-67187 being exploited?
There is no known exploitation of CVE-2026-67187 in the wild and no public exploit code.
Sources
Also known as GHSA-f833-cw2q-6hm3.