CVE-2026-65051: Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-21 · updated 2026-10-24
Weakness: CWE-602

Description

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.

Affected products

kstover Ninja Forms – The Contact Form Builder That Grows With You: before 3.14.9 — fixed in 3.14.9

How to fix

Upgrade to a fixed version: kstover Ninja Forms – The Contact Form Builder That Grows With You 3.14.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-65051 or the next vulnerability affects your stack