CVE-2026-65052: Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the getcalcvalue() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ninja Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.14.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65052?
CVE-2026-65052 has a severity rating of high, specifically a score of 7.5.
What does CVE-2026-65052 affect?
CVE-2026-65052 affects the Ninja Forms WordPress plugin versions 3.14.8 and prior.
How do I fix CVE-2026-65052?
To fix CVE-2026-65052, update the Ninja Forms plugin to the latest version that is not vulnerable.
What type of vulnerability is CVE-2026-65052?
CVE-2026-65052 is an input validation vulnerability.
What can attackers do with CVE-2026-65052?
Attackers can exploit CVE-2026-65052 to inject arbitrary numeric values into form calculations and payment totals.