CVE-2026-15663 is an SQL Injection vulnerability in the Ninja Forms WordPress plugin (up to version 3.14.9). The flaw exists in the handling of the 'settings' key from attacker-controlled import files, which are processed via file_get_contents() or base64-decoded/JSON-decoded data. The plugin escapes only the value side of these keys but fails to sanitize or parameterize the key side before incorporating it into SQL queries in two functions: _save_setting() in Model.php and insert_form_meta() in ImportForm.php. This allows authenticated users with administrator privileges to inject additional SQL commands, potentially extracting sensitive database information. The vulnerability bypasses wp_magic_quotes protections due to the import file processing method. No patch or official fix has been documented as of the publication date.

An authenticated attacker with administrator-level access can exploit this vulnerability to perform SQL Injection by injecting malicious SQL through the 'settings' key in import files. This can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability directly, but confidentiality is at risk. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict import file usage to trusted sources only and limit administrator access to trusted personnel. Monitor official vendor channels for updates or patches addressing this vulnerability.