CVE-2026-65052: Ninja Forms 0 to before 3.14.9

CVE-2026-65052. CVSS 3.1 base score 7.5 (HIGH, Vendor/CNA). EPSS 0.00581 (percentile 0.47094), scored 24-Oct-2026.

Affected technology

Ninja Forms · 0 to before 3.14.9
Saturday Drive

Description’s affected range: version 3.14.8 and prior

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attackers can inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality and availability impact as none; integrity impact as high.

Published 25-Oct-2026 01:30 UTC

CWE: CWE-472
CCR priority: 30.1 /100 (P4)
CVSS 3.1: 7.5 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · Vendor/CNA
EPSS: 0.00581 · percentile 0.47094 · 2026-10-24
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-65052.html