Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via Merge Tags
- ID
- WPSEC-2026-1134
- Plugin
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (ninja-forms)
- Affected
- all versions before 3.15.6
- Remediation
- Update to 3.15.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Ninja Forms on WPSec AttackSurface
- Fix released
- Published
Description
The Ninja Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via merge tags in all versions up to, and including, 3.15.5. This is due to values substituted through merge tags, such as submitted field values, {wp:user_display_name}, user meta and post meta, being inserted into the Success Message and field default values, which are later passed to do_shortcode(), without neutralizing shortcode brackets. Submitted field values only pass through strip_shortcodes(), and that function turns an escaped tag like [[tag]] into [tag]. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting a form whose Success Message contains a field merge tag. Authenticated attackers with subscriber-level access can do the same through their own profile values on forms that use user merge tags in default values.
References
- https://wpsec.com/vuln/WPSEC-2026-1134/
- https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.6/
- https://wordpress.org/plugins/ninja-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS