CVE-2026-15663

Name of the Vulnerable Software and Affected Versions Ninja Forms versions prior to 3.15.0

Description An issue exists where authenticated attackers with administrator-level access can perform SQL Injection by manipulating the settings key within an import file. This occurs because the software fails to properly escape user-supplied parameters and lacks sufficient preparation of SQL queries. The vulnerability is triggered when the settings object is processed via file get contents() or base64/JSON-decoded blobs, which bypasses wp magic quotes protections. Specifically, the save setting() function in Model.php and the insert form meta() function in ImportForm.php are affected because sanitization is only applied to the value side, leaving the key side unprotected. This allows attackers to append malicious SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 3.14.9.