CVE-2026-65051 affects Ninja Forms version 3.14.8 and involves a client-side enforcement flaw that permits unauthenticated attackers to bypass server-side form validation. Attackers can merge attacker-controlled field metadata over server-loaded form definitions before validation runs, enabling them to override field types, remove required flags, and disable CAPTCHA checks. This is achieved through the nopriv AJAX endpoint, allowing malicious submissions that trigger form actions such as email notifications and database storage with unverified content. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available.

The vulnerability allows unauthenticated attackers to bypass all form validation mechanisms, including required fields and CAPTCHA protections. This can lead to the processing and storage of attacker-controlled, unverified data, potentially resulting in unauthorized email notifications and database entries. The integrity of form submissions is compromised, which may facilitate further attacks or abuse of the affected website's functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the vulnerable AJAX endpoint (nopriv) if possible, or implementing additional server-side validation controls independent of client-side metadata. Monitor vendor communications for updates on patches or official mitigations.