Requests to the Ninja Forms plugin that include IP or Referer merge tags can contain WordPress shortcodes. Because the plugin substitutes these request‑derived values into content without sanitization or validation, any shortcode present in the value is executed during the subsequent shortcode processing stage. An unauthenticated attacker can thus inject and execute any shortcode that is registered on the site, potentially allowing the execution of arbitrary code, data exfiltration, or modification of site content. The vulnerability leverages the lack of protection around user‑supplied input used inside plugin content.

The affected product is the Ninja Forms WordPress plugin, version 3.14.10 up to and including 3.15.1. The plugin is commonly installed on WordPress sites; earlier releases prior to 3.15.2 are vulnerable. No specific vendor beyond the "Ninja Forms" plugin is listed, but the plugin functions within the WordPress CMS environment.

The CVSS base score of 4.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation to date. However, because no authentication is required and the attack can be performed via a crafted HTTP request or by manipulating IP and Referer merge tags, an attacker with internet access can exploit the flaw. If the site has registered shortcodes that perform privileged actions, the impact could be significant, ranging from data manipulation to full site compromise.