CVE-2026-65051: Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/ninja-formsto a version that resolves this vulnerability.Fixed in 3.14.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65051?
CVE-2026-65051 has a medium severity rating of 6.5.
How do I fix CVE-2026-65051?
To fix CVE-2026-65051, update the Ninja Forms WordPress plugin to the latest version.
What vulnerability does CVE-2026-65051 describe?
CVE-2026-65051 describes a server-side validation bypass vulnerability in the Ninja Forms WordPress plugin.
Who is affected by CVE-2026-65051?
Unauthenticated attackers can exploit CVE-2026-65051 to bypass form validation.
What is the attack vector for CVE-2026-65051?
The attack vector for CVE-2026-65051 is client-controlled field metadata during AJAX form submission.