株式会社mgn@mgn_jpn
🛠 Ninja Forms の脆弱性が修正されました（深刻度 中） 60万サイト以上が利用 / CVSS 5.1 3.15.4 に更新してください https://shindan.m-g-n.me/alerts/cve-2026-67187/
05042544
486 followersView on X
CVE-2026-67187
LOWCVSS 5.1 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-1236
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
By indicator