CVE-2026-101326: Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name

Q: What conditions must be present for exploitation to work?

An attacker must have an authenticated WordPress account with Subscriber-level access or higher. An administrator must also have configured at least one Ninja Forms field on a publicly accessible page with the Default Value set to the {wp:user_display_name} merge tag.

Q: Are default Ninja Forms installations affected?

The issue requires a specific form-field configuration using {wp:user_display_name} as the Default Value and public access to the page containing that form. The provided information does not establish that this configuration is enabled by default.

Q: How can I determine whether my site is exposed?

Review publicly accessible pages containing Ninja Forms and identify fields whose Default Value is {wp:user_display_name}. If such a field exists, users with Subscriber-level or higher accounts can set their display_name to a shortcode string and trigger shortcode execution by visiting the page.

Q: What can be done if updating is not immediately possible?

Remove {wp:user_display_name} from the Default Value of Ninja Forms fields on publicly accessible pages. Restricting or removing Subscriber-level accounts also reduces the set of users able to exploit the issue.

Published Oct 31, 2026

Updated

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. Exploitation requires that an administrator has configured at least one Ninja Forms field with its Default Value set to the {wp:userdisplayname} merge tag on a publicly accessible page; a Subscriber need only set their displayname to a shortcode string via their profile and then visit that page.

Event History

Oct 31, 2026

CVE Published

via MITRE·05:33 AM

Data Sourced

via MITRE·05:33 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions must be present for exploitation to work?

An attacker must have an authenticated WordPress account with Subscriber-level access or higher. An administrator must also have configured at least one Ninja Forms field on a publicly accessible page with the Default Value set to the {wp:user_display_name} merge tag.

Are default Ninja Forms installations affected?

The issue requires a specific form-field configuration using {wp:user_display_name} as the Default Value and public access to the page containing that form. The provided information does not establish that this configuration is enabled by default.

How can I determine whether my site is exposed?

Review publicly accessible pages containing Ninja Forms and identify fields whose Default Value is {wp:user_display_name}. If such a field exists, users with Subscriber-level or higher accounts can set their display_name to a shortcode string and trigger shortcode execution by visiting the page.

What can be done if updating is not immediately possible?

Remove {wp:user_display_name} from the Default Value of Ninja Forms fields on publicly accessible pages. Restricting or removing Subscriber-level accounts also reduces the set of users able to exploit the issue.

CVE-2026-101326: Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name

Event History

Frequently Asked Questions

What conditions must be present for exploitation to work?

Are default Ninja Forms installations affected?

How can I determine whether my site is exposed?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What conditions must be present for exploitation to work?

Are default Ninja Forms installations affected?

How can I determine whether my site is exposed?

What can be done if updating is not immediately possible?