CVE-2026-65051 affects Ninja Forms version 3.14.8 by allowing unauthenticated attackers to bypass all form validation through client-side enforcement weaknesses. Attackers exploit the nopriv AJAX endpoint to merge attacker-controlled field metadata over server-loaded form definitions before validation occurs. This manipulation disables key validation mechanisms such as required fields and CAPTCHA, enabling the submission of malicious content that can trigger form actions including email notifications and database storage with unverified data.

The vulnerability enables unauthenticated attackers to bypass form validation controls, potentially leading to the injection of attacker-controlled data into email notifications and database storage. This could result in data integrity issues, spam, or other unintended actions triggered by the form processing logic. However, there is no indication of remote code execution or privilege escalation. The CVSS score of 6.9 reflects a medium severity impact with network attack vector and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, administrators should consider disabling the affected AJAX endpoint or restricting access to it if possible, and monitor for suspicious form submissions.