Vulnerability in Saturday Drive Ninja Forms
CVE-2026-65051
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.005 (41.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 41.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Saturday Drive Ninja Forms — versions 0, 3.14.9
Weakness classification (CWE)
References
- wordpress.org/plugins/ninja-forms/ (product)
- wordpress.org/plugins/ninja-forms/changelog/ (patch)
- www.vulncheck.com/advisories/ninja-forms-server-side-validation-bypass-via-clie… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-65051?
- CVE-2026-65051 is a medium-severity vulnerability in Saturday Drive Ninja Forms, classified under CWE-602. CVSS score: 6.5/10. Published 2026-07-21.
- How severe is CVE-2026-65051?
- Medium severity. CVSS v3 base score is 6.5 out of 10.