CVE-2026-65052: External Control of Assumed-Immutable Web Parameter in Saturday Drive Ninja Forms
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.
AI Analysis
Technical Summary
CVE-2026-65052 is an improper input validation vulnerability in the Ninja Forms WordPress plugin by Saturday Drive, affecting version 3.14.8 and prior. Attackers can submit crafted payloads to the ajax submit endpoint with values outside the expected options for ListSelect or ListRadio fields. This causes the get_calc_value() method to fail open, returning attacker-controlled numeric values that manipulate form calculations and payment totals. The vulnerability allows unauthenticated attackers to bypass pricing logic by setting payment amounts to zero or arbitrary figures.
Potential Impact
The vulnerability allows unauthenticated attackers to manipulate payment amounts in forms, potentially bypassing pricing controls set by administrators. This can lead to financial loss or abuse of payment-related functionality within affected websites using the vulnerable Ninja Forms versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, consider restricting access to form submission endpoints or implementing additional input validation controls at the application or web server level to mitigate exploitation.
CVE-2026-65052: External Control of Assumed-Immutable Web Parameter in Saturday Drive Ninja Forms
Description
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.
CVSS v4.0
Score 8.7high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-65052 is an improper input validation vulnerability in the Ninja Forms WordPress plugin by Saturday Drive, affecting version 3.14.8 and prior. Attackers can submit crafted payloads to the ajax submit endpoint with values outside the expected options for ListSelect or ListRadio fields. This causes the get_calc_value() method to fail open, returning attacker-controlled numeric values that manipulate form calculations and payment totals. The vulnerability allows unauthenticated attackers to bypass pricing logic by setting payment amounts to zero or arbitrary figures.
Potential Impact
The vulnerability allows unauthenticated attackers to manipulate payment amounts in forms, potentially bypassing pricing controls set by administrators. This can lead to financial loss or abuse of payment-related functionality within affected websites using the vulnerable Ninja Forms versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, consider restricting access to form submission endpoints or implementing additional input validation controls at the application or web server level to mitigate exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-21T14:05:53.719Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5f856e2a4a8d598947260e
Added to database: 07/21/2026, 14:42:54 UTC
Last enriched: 07/21/2026, 14:56:46 UTC
Last updated: 07/21/2026, 17:41:43 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.