Unvalidated input for Checkbox List, Multi‑Select List, Image List, Country, and State fields in Ninja Forms allows attackers to submit arbitrary values through the public nf_ajax_submit endpoint, bypassing normal server‑side validation. Because the generic list validator only checks for field presence, attackers can embed formula payloads that are not protected by the CSV escaping applied to text inputs. When an administrator downloads the exported submissions file, these payloads are interpreted as CSV formulas, leading to CSV injection that can expose sensitive data or compromise the database.

The vulnerability is present in the Ninja Forms WordPress plugin for all versions earlier than 3.15.4. Administrators using any of the affected list field types—Checkbox List, Multi‑Select List, Image List, Country, or State—are at risk if the plugin version falls below the specified threshold.

The CVSS score of 5.1 indicates moderate risk. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting that large‑scale exploitation is currently unknown. Attackers can exploit the flaw without authentication by sending crafted requests to nf_ajax_submit, then wait for an administrator to export submissions. The potential impact is limited to CSV injection, but the effect can be significant if sensitive data is exposed or execution of arbitrary formulas occurs.