FR
live
High CVSS 7.5

CVE-2026-65052

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.

What this means

Exposure
Exploitable remotely over the network, without authentication and with no action from the victim.
Impact
An attacker can modify or destroy data.
Likelihood
Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.

What to doFold into the next patch cycle. Start with the instances exposed to the internet.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published
21 July 2026
CVSS
7.5 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.36% probability of exploitation within 30 days · above 29% of all CVEs
Weakness
CWE-472
Sources
nvd
References

Type at least two characters.

navigate open esc dismiss