CVE-2026-80437

Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

Affected

Ninja Forms

CVSS v3.1 WPSCAN

4.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2026-09-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/473a3321-7dc6-454a-82f4-89b6a393d09a/

References

• CVE Record
• NVD entry