CVE-2026-65052 is an improper input validation vulnerability in the Ninja Forms WordPress plugin (Saturday Drive) affecting versions up to and including 3.14.8. The flaw allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not correspond to any configured option in ListSelect or ListRadio fields. This manipulation targets the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values. Consequently, attackers can bypass admin-configured pricing logic to set payment amounts to zero or arbitrary figures. The CVSS 4.0 base score is 8.7 (high severity), reflecting network attack vector, no privileges or user interaction required, and high impact on integrity.

The vulnerability enables unauthenticated attackers to tamper with form submission payloads, manipulating payment amounts arbitrarily, including setting them to zero. This bypasses the intended pricing logic configured by administrators, potentially leading to financial loss or fraud. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, restrict access to the ajax submit endpoint if possible and monitor for suspicious form submissions.