CVE-2026-100155: Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it remotely. The reported attack vector is network-accessible and requires no privileges or user interaction.
What is required for exploitation?
The attacker needs to supply a crafted value in the formData field that reaches a Success Message merge tag and is processed by do_shortcode. No authentication is required.
Which installations are affected?
All versions of the Ninja Forms WordPress plugin up to and including 3.15.5 are affected. The supplied data does not identify a fixed version.
What is the likely impact?
Successful exploitation allows execution of arbitrary shortcodes. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.