CVE-2026-65051 Details

A vulnerability in the Ninja Forms WordPress plugin, specifically in version 3.14.8, allows unauthenticated attackers to bypass form validation. This is achieved by merging attacker-controlled field metadata with server-loaded form definitions before the validation process. Exploiting this vulnerability, attackers can manipulate AJAX submissions to override field types, remove required flags, and disable CAPTCHA checks. The exploitation occurs through the nopriv AJAX endpoint, enabling attackers to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.

Users are advised to update to Ninja Forms version 3.14.9 or later, where this vulnerability has been fixed.