The Ninja Forms plugin allows administrators to import form configurations through JSON or base64‑encoded files. In versions up to 3.14.9 the plugin fails to sanitize the key portion of the settings array when building SQL queries. An attacker with administrator or higher privileges can craft a settings key that contains additional SQL statements, causing the underlying query to execute multiple commands. This classic SQL injection flaw (CWE‑89) enables the attacker to read or modify sensitive data stored in the WordPress database.

All WordPress installations that have the Ninja Forms plugin version 3.14.9 or earlier are affected. The flaw is triggered through the plugin’s import functionality, which can be accessed via the WordPress admin interface.

The CVSS score of 4.9 indicates moderate severity, while an EPSS score of less than 1% suggests a very low exploit probability in the wild. The vulnerability is not listed in CISA KEV. Exploitation requires authenticated access with administrator rights, and the attacker must upload a malicious import file containing the injected key. Although the potential impact is limited to database read or write operations rather than remote code execution, the exposed data can be sensitive. Prompt remediation is recommended because of the risk of data disclosure and the ease with which an authorized user can create the malformed import file.