Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields

published 2026-07-21 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-46272

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits: 0; none known

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.

Patch / fix

fixed in 1 links 1

Saturday Drive Ninja Forms 3.14.9

wordpress.org/plugins/ninja-forms/changelog/ patch

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 3 mo ago (2026-07-22)

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Saturday Drive Ninja Forms

Classification

Weakness

CWE-472 External Control of Assumed-Immutable Web Parameter

Technology feeds

WordPress rss critical rss

References

wordpress.org /plugins/ninja-forms/changelog/
patch
wordpress.org /plugins/ninja-forms/
product
vulncheck.com /advisories/ninja-forms-calculation-and-payment-total-tampering-via-fail-open-get-calc-value-in-listselect-and
third-party-advisory

Sources

CVE List CVE-2026-65052
NVD CVE-2026-65052

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary