Ninja Forms permits unauthenticated shortcode execution through query-string defaults
Ninja Forms before 3.14.10 allows query-string data used to pre-populate a form field's default value to be processed as shortcode markup. When a configured form is embedded publicly, an unauthenticated attacker can place a registered shortcode in that query value and cause WordPress to execute it while rendering the form. Impact depends on registered shortcodes and may include data disclosure or side effects. The query parameter, field setting, rendering endpoint and PHP function are not disclosed.
- Component
- Ninja Forms
- Plugin slug
ninja-forms- Affected
- < 3.14.10
- Safe version
3.14.10- Published
- Aug 06, 2026
This CVE was published Aug 06, 2026 and is one of 74 known issues for this plugin.
Update, patch or deactivate.
Update Ninja Forms to 3.14.10 or later. Until updated, disable query-string prepopulation on public forms and review registered shortcodes for sensitive side effects.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N