CVE-2026-15256

Deferred Deferred - Pending Action

Unauthenticated Shortcode Execution in Ninja Forms

Publication date: 2026-08-06

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-15256

Affected Vendors & Products

Vendor	Product	Version / Range
ninja_forms	ninja_forms	to 3.14.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Ninja Forms WordPress plugin before version 3.14.10. It allows unauthenticated attackers to execute arbitrary shortcodes on a WordPress site by manipulating query-string input used to pre-populate form fields. The issue arises because user-supplied input is not properly sanitized and is processed as a shortcode when a vulnerable form is embedded on a public page.

Detection Guidance

Check if the Ninja Forms plugin version is below 3.14.10 by inspecting the WordPress admin panel or using commands like 'wp plugin list' in WP-CLI. Look for forms configured to use user-supplied input in default field values.

Impact Analysis

If you use the Ninja Forms plugin before version 3.14.10, attackers could exploit this to run malicious shortcodes on your site. This could lead to unauthorized actions, data leaks, or further compromise of your WordPress installation. Publicly accessible forms configured to use query-string input for default values are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, which may violate GDPR or HIPAA requirements for data protection and integrity. If exploited, it could result in data breaches, unauthorized processing of personal data, or failure to maintain secure systems, potentially leading to regulatory penalties or legal consequences.

Mitigation Strategies

Update the Ninja Forms plugin to version 3.14.10 or later immediately. If updating is not possible, disable the plugin temporarily or restrict access to forms using user-supplied input until patched.

Hi! I’m here to help you understand CVE-2026-15256. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70