{"id":"CVE-2026-67187","kind":"vulnerability","aliases":["CVE-2026-67187"],"related":[],"title":"WordPress Ninja Forms: unauthenticated submissions can inject formulas into CSV exports","description":"Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.","summary":"Ninja Forms before 3.15.4 fails to validate list-type form fields on the server, so anyone can submit crafted values that bypass CSV escaping. When an administrator opens an exported submissions file, spreadsheet formulas in those values can run.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ninja-forms","package","self-hosted","wordpress"],"not_affected_if":["ninja-forms-3.15.4-or-later","no-list-fields","no-public-forms"],"how_to_check":"- Check the installed Ninja Forms version in the WordPress admin plugin list or with `wp plugin get ninja-forms --field=version`\n- Confirm whether forms use Checkbox List, Multi-Select List, Image List, Country or State fields","fix":"- Update Ninja Forms to `3.15.4` or later\n- Until updated, avoid exporting submissions to CSV and do not open exported files in spreadsheet software","status":"open","published_at":"2026-10-28T16:17:08+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:54+00:00","updated_at":"2026-10-28T16:35:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T16:35:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update Ninja Forms to `3.15.4` or later\n- Until updated, avoid exporting submissions to CSV and do not open exported files in spreadsheet software","reach":"internet","title":"WordPress Ninja Forms: unauthenticated submissions can inject formulas into CSV exports","impact":"medium","summary":"Ninja Forms before 3.15.4 fails to validate list-type form fields on the server, so anyone can submit crafted values that bypass CSV escaping. When an administrator opens an exported submissions file, spreadsheet formulas in those values can run.","category":"package","nicknames":[],"who_cares":["wordpress","ninja-forms","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Spreadsheet formulas in submissions run on an admin's computer when opened","analyst_note":"Confirm the exact fixed version and whether the nf_ajax_submit endpoint is reachable on default configs; NVD page is the only source.","how_to_check":"- Check the installed Ninja Forms version in the WordPress admin plugin list or with `wp plugin get ninja-forms --field=version`\n- Confirm whether forms use Checkbox List, Multi-Select List, Image List, Country or State fields","needs_analyst":true,"not_affected_if":["no-public-forms","no-list-fields","ninja-forms-3.15.4-or-later"],"who_is_affected":"Sites running Ninja Forms before 3.15.4 that accept public submissions on forms containing list-type fields (Checkbox List, Multi-Select List, Image List, Country, State). The risk lands on administrators who download and open the CSV export. Sites with no public forms, or only text-only forms, are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":3429,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-67187':14A,17A '3.15.4':29B,72C 'abstract':104C 'administr':53B,149C 'ajax':129C 'allow':82C 'anyon':42B 'appli':136C 'arbitrari':87C 'attack':84C,119C 'bypass':48B,133C 'check':114C 'checkbox':90C 'contain':73C 'countri':98C 'craft':45B,122C 'csv':10A,49B,134C,145C 'cve':12A,15A 'download':150C 'endpoint':131C 'escap':50B,135C 'export':11A,56B,154C 'fail':30B 'fall':106C 'field':37B,101C,117C,142C 'file':58B,156C 'form':3A,20B,27B,36B,67C 'formula':8A,60B,123C 'host':24B 'imag':96C 'incomplet':75C 'inject':7A,146C 'list':34B,91C,95C,97C,105C 'list-typ':33B 'method':111C 'multi':93C 'multi-select':92C 'nf':103C,128C 'ninja':2A,19B,26B,66C 'ninja-form':18B 'open':54B,152C 'packag':21B 'payload':124C 'plugin':68C 'presenc':118C 'requir':116C 'required-field':115C 'result':143C 'run':65B 'select':94C 'self':23B 'self-host':22B 'server':40B,77C 'server-sid':76C 'side':78C 'spreadsheet':59B 'state':100C 'submiss':5A,57B,155C 'submit':44B,86C,121C,130C 'textarea':141C 'textbox':139C 'type':35B 'unauthent':4A,83C,127C 'valid':32B,79C,110C 'valu':46B,63B,88C 'vulner':80C 'wordpress':1A,25B,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running Ninja Forms before 3.15.4 that accept public submissions on forms containing list-type fields (Checkbox List, Multi-Select List, Image List, Country, State). The risk lands on administrators who download and open the CSV export. Sites with no public forms, or only text-only forms, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67187","severity":null,"published_at":"2026-10-28T16:17:08+00:00","modified_at":"2026-10-28T16:17:08+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}