Read the docs
TI-2026-46459 Aliases CVE-2026-65051GHSA-q572-6pwx-4p26

Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Priority LOW 37CWE-602Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00491 42nd percentileScored 2026-11-07
Fix Fixed Ninja Forms (Saturday Drive): 3.14.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Saturday DriveNinja Formsbefore 3.14.93.14.9Patch availableCNA
  • Ninja Forms VendorSaturday Drive Affected before 3.14.9 Fixed in 3.14.9 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:*:*:*——Saturday Drive
  • cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:*:*:* Versions — — ·Saturday Drive

Remediation

  • Fix · CNA Ninja Forms (Saturday Drive) Fixed in 3.14.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Saturday Drive Ninja Forms 3.14.9

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-46460 Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio FieldsPriority MEDIUM 44
    • TI-2026-46456 Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission IndexPriority MEDIUM 43
    • TI-2026-46457 Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX ActionPriority LOW 37
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65051
  2. 2026-10-03 Alias added: GHSA-q572-6pwx-4p26

References

Patch 1

Other 1

  • TI-2026-00527 Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2025-08325 Ninja-forms < 3.11.1 - Unauthenticated PHP Objection CVSS 3.1CRITICAL 9.8
  • TI-2016-01107 The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct… CVSS 3.0CRITICAL 9.8
  • TI-2023-19777 WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability CVSS 3.1HIGH 8.8
  • TI-2022-00792 Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2022-02691 NinjaForms < 3.6.13 - Admin+ PHP Objection Injection CVSS 3.1HIGH 7.2
See all 94 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences