The Ninja Forms WordPress plugin fails to sanitize user-supplied query-string input that is used to pre‑populate a form field’s default value. As a result, an unauthenticated attacker can embed arbitrary shortcodes in the URL so that when a form configured in this way is loaded on a public page, those shortcodes are processed and executed by the site’s PHP runtime. This flaw allows the execution of any shortcode registered on the site, potentially leading to arbitrary code execution, data exfiltration, or content tampering. The issue carries a CVSS score of 4.8, indicating moderate severity.

The impacted component is the Ninja Forms plugin for WordPress, affecting all installed versions prior to 3.14.10. No other vendors or products are listed as affected.

No authentication is required and the attack vector is a simple crafted URL that includes a query-string parameter to set a form field default. The exploit is trivial for an attacker who can reach a public page that renders the vulnerable form, and because any shortcode registered on the site will run, the actual impact depends on the attacker’s choice of shortcode. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of input validation combined with the ability to execute arbitrary shortcodes means that once discovered, the flaw could be used repeatedly against any site using an outdated Ninja Forms installation.