{"id":"CVE-2026-67187","aliases":[],"cve":{"records":[{"id":"CVE-2026-67187","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-28T16:06:49.773Z","published":"2026-10-28T15:19:16.649Z","modified":"2026-11-03T13:01:20.814Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-28T15:19:16.649Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-03T13:01:20.814Z"}],"references":[{"url":"https://wordpress.org/plugins/ninja-forms/#developers","tags":["release-notes","patch"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/ninja-forms-wordpress-plugin-server-side-validation-bypass-via-list-fields","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-1236","description":"Improper Neutralization of Formula Elements in a CSV File","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-03T13:01:02.972888Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.","score":7.1,"severity":"high","published":"2026-10-28T15:19:16.649Z","modified":"2026-11-03T13:01:20.814Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Saturday Drive","name":"Ninja Forms","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.15.4","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-67187"}],"remediation":[],"references":["https://wordpress.org/plugins/ninja-forms/#developers","https://www.vulncheck.com/advisories/ninja-forms-wordpress-plugin-server-side-validation-bypass-via-list-fields"],"sources":[{"name":"CVE","id":"CVE-2026-67187","modified":"2026-11-03T13:01:20.814Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-67187"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","score":5.1},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","score":7.1}],"sourceAffected":[],"observedAt":"2026-11-03T13:20:52.166Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:55:32.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-03T13:25:37.269Z","attemptedAt":"2026-11-03T13:25:37.269Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-03T13:25:37.138Z","attemptedAt":"2026-11-03T13:25:37.138Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-03T13:25:37.903Z","attemptedAt":"2026-11-03T13:25:37.903Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-03T13:25:36.073Z","attemptedAt":"2026-11-03T13:25:36.073Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-67187","url":"https://www.first.org/epss/","probability":0.00172,"percentile":0.0655,"date":"2026-11-02","checkedAt":"2026-11-03T13:25:36.073Z"},{"source":"GitHub Advisory Database","id":"GHSA-f833-cw2q-6hm3","url":"https://github.com/advisories/GHSA-f833-cw2q-6hm3","modified":"2026-10-28T18:32:10Z","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","checkedAt":"2026-11-03T13:25:37.138Z"},{"source":"NVD","id":"CVE-2026-67187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67187","modified":"2026-11-03T13:17:23.207","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-03T13:25:37.269Z"},{"source":"NVD","id":"CVE-2026-67187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67187","modified":"2026-11-03T13:17:23.207","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","checkedAt":"2026-11-03T13:25:37.269Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112137","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112137","modified":"Oct 28, 2026, 3:19:16 PM","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","checkedAt":"2026-11-03T13:25:37.903Z"}],"aiSummary":{"text":"Ninja Forms WordPress plugin versions before 3.15.4 have an incomplete server-side validation weakness, allowing unauthenticated attackers to submit arbitrary values to certain fields. This can result in CSV injection when an administrator downloads and opens the exported submissions file. Attackers can exploit this via the unauthenticated nf_ajax_submit endpoint.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:16:59.516Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-67187"}]}}