CVE-2026-65051

Name of the Vulnerable Software and Affected Versions Ninja Forms version 3.14.8

Description An issue exists where client-side enforcement is used for server-side security, allowing unauthenticated attackers to bypass all form validation. This is achieved by merging attacker-controlled field metadata over server-loaded form definitions before validation occurs. By crafting a malicious AJAX request to the nopriv AJAX endpoint, attackers can override field types, remove required flags, and disable CAPTCHA checks. This allows the triggering of form actions, such as email notifications and database storage, using unverified content controlled by the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.