Dashboard / CVE-2026-67187

CVE-2026-67187

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 60/100
Published: 2026-10-28 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Active
AT: None
VC: None
VI: None
VA: None

Description

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Saturday Drive Ninja Forms 0 < 3.15.4
Saturday Drive Ninja Forms 0 < 3.15.4

References & Advisories (2)

Bug Bounty Relevance

60 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

EPSS — Exploitation Probability

0.17%
Raw Score 0.001720
Percentile 6.6%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links