{"id":"CVE-2026-67187","published":"2026-10-28T16:17:08.767","lastModified":"2026-10-28T16:17:08.767","description":"Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cwes":["CWE-1236"],"vendors":[],"products":[],"references":[{"url":"https://wordpress.org/plugins/ninja-forms/#developers","tags":[]},{"url":"https://www.vulncheck.com/advisories/ninja-forms-wordpress-plugin-server-side-validation-bypass-via-list-fields","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}