Ninja Forms WordPress Plugin: Unauthenticated Shortcode Injection Vulnerability (CVE-2026-80437)

What Happened

The Ninja Forms WordPress plugin, in versions from 3.14.10 up to (but not including) 3.15.2, does not prevent shortcodes contained in request-derived values from being executed when those values are later substituted into content that the plugin processes for shortcodes. As a result, an unauthenticated user can cause the site to run any shortcode that is registered on it, simply by crafting appropriate request input.

Technical Cause

The root cause is insufficient sanitization or filtering of user-supplied, request-derived values before they are inserted into content that is subsequently parsed for shortcodes. Because WordPress shortcode processing will execute any recognized shortcode found in content, injecting a shortcode string through request data causes it to run with the privileges and effects normally associated with that shortcode, without requiring authentication.

Why It Matters

Because the attacker does not need to be authenticated and no user interaction is required, this vulnerability can be exploited remotely by any visitor to a site running the affected plugin. The practical impact depends on which other shortcodes are registered on the site — some shortcodes may expose limited information or trigger limited actions (reflected in the CVSS impact scores of low confidentiality and integrity impact, no availability impact), while the broader risk depends on the site's specific plugin and theme ecosystem.

Who Is Affected

Any WordPress site running the Ninja Forms plugin in a version from 3.14.10 up to (but not including) 3.15.2 is affected. Ninja Forms is reported to have more than 500,000 active installations, making this a widely deployed plugin.

Affected Versions

Affected: Ninja Forms versions from 3.14.10 up to, but not including, 3.15.2. The advisory data references version 3.15.2 as the boundary marking the end of the affected range, but it does not explicitly confirm that 3.15.2 or any later version contains a fix.

Fixes and Mitigation

The fact package indicates that no fix is currently confirmed to be available for this vulnerability. We cannot state with certainty that upgrading to version 3.15.2 resolves the issue, since this was not explicitly confirmed in the source data. Site operators should monitor the official Ninja Forms plugin changelog and the WordPress plugin repository for an update addressing this issue.

Recommended Action

Site administrators running Ninja Forms should check their installed version and consult official vendor channels for a confirmed security update. Until a fix is confirmed, consider auditing which shortcodes are registered on the site to understand potential exposure, and monitor for unusual form submission activity. Apply any available plugin update promptly once the vendor confirms a patched release.