CVE-2026-65052

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin versions prior to 3.14.9

Description Improper input validation allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals. This occurs when values are submitted that do not match any configured option in ListSelect or ListRadio fields. By tampering with form submission payloads sent to the ajax submit endpoint, attackers can cause the get calc value() method to fail open and return attacker-controlled values. This enables the manipulation of payment amounts to zero or other arbitrary figures, bypassing admin-configured pricing logic.

Recommendations Update Ninja Forms WordPress plugin to version 3.14.9 or later.