---
id: "CVE-2026-67187"
kind: "vulnerability"
aliases: ["CVE-2026-67187"]
title: "WordPress Ninja Forms: unauthenticated submissions can inject formulas into CSV exports"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ninja-forms", "package", "self-hosted", "wordpress"]
not_affected_if: ["ninja-forms-3.15.4-or-later", "no-list-fields", "no-public-forms"]
published_at: "2026-10-28T16:17:08+00:00"
first_seen_at: "2026-10-28T16:33:49+00:00"
updated_at: "2026-10-28T16:35:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67187", "first_seen_at": "2026-10-28T16:33:49+00:00"}]
---

# WordPress Ninja Forms: unauthenticated submissions can inject formulas into CSV exports

Ninja Forms before 3.15.4 fails to validate list-type form fields on the server, so anyone can submit crafted values that bypass CSV escaping. When an administrator opens an exported submissions file, spreadsheet formulas in those values can run.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Ninja Forms version in the WordPress admin plugin list or with `wp plugin get ninja-forms --field=version`
- Confirm whether forms use Checkbox List, Multi-Select List, Image List, Country or State fields

## Fix

- Update Ninja Forms to `3.15.4` or later
- Until updated, avoid exporting submissions to CSV and do not open exported files in spreadsheet software

## Timeline

- 2026-10-28T16:33:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67187

## From the sources

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_