---
id: CVE-2026-67187
title: >-
  Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List
  Fields
summary: >-
  Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete
  server-side validation vulnerability that allows unauthenticated attackers to
  submit arbitrary values to Checkbox List, Multi-Select List, Image List,
  Country, and Sta…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-1236
vendor: Saturday Drive
product: Ninja Forms
affected:
  - ninja_forms < 3.15.4
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T15:19:16.649Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-67187'
references:
  - url: 'https://wordpress.org/plugins/ninja-forms/#developers'
    label: WordPress Plugin Changelog
  - url: >-
      https://www.vulncheck.com/advisories/ninja-forms-wordpress-plugin-server-side-validation-bypass-via-list-fields
    label: >-
      VulnCheck Advisory: Ninja Forms WordPress Plugin < 3.15.4 Server-Side
      Validation Bypass via List Fields
tags:
  - cve.org
ingestedAt: '2026-10-28T16:13:50.589Z'
---

## Overview

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

## Affected

- `ninja_forms < 3.15.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.