The vulnerability arises from improper validation of user input in Ninja Forms version 3.14.8 and earlier, allowing an attacker to supply numeric values that do not match any configured option in ListSelect or ListRadio fields. By submitting a crafted payload to the Ajax form submission endpoint, the get_calc_value() method fails open and returns attacker‑controlled values. This flaw can cause the calculation of form totals and payment amounts to be redirected to zero or arbitrary figures, effectively bypassing any payment logic configured by the administrator. The flaw is classified as CWE‑472.

The affected system is the Ninja Forms WordPress plugin developed by Saturday Drive. Versions 3.14.8 and any earlier releases are vulnerable; newer releases are not known to be affected.

The CVSS score of 8.7 indicates a high severity level, while the EPSS score of less than 1 % suggests that the exploit is currently unlikely to be widely deployed. The vulnerability can be triggered remotely by unauthenticated attackers only by sending a specially crafted HTTP request to the plugin’s Ajax endpoint, so no privileged access is required. Because the flaw allows the creation of fraudulent payment totals, the potential business impact is significant, particularly for sites accepting online payments. However, the limited exploit probability and lack of evidence in the CISA KEV catalog indicate that immediate risk is moderate, and controlling for it is advisable as a preventative measure.