PT-2026-61955 · Saturday Drive · Ninja Forms

Pavel Kohout · CVE-2026-65052 · Publicado 2026-07-21 · Atualizado 2026-07-21

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get calc value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.

Correção

Enumeração de Fraquezas

CWE-472

Identificadores relacionados

CVE-2026-65052

Produtos afetados

Ninja Forms

Referências · 4

• https://wordpress.org/plugins/ninja-forms/changelog · Correção
• https://wordpress.org/plugins/ninja-forms · Nota
• https://vulncheck.com/advisories/ninja-forms-calculation-and-payment-total-tampering-via-fail-open-get-calc-value-in-listselect-and-listradio-fields · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-65052 · Nota de Segurança