WordPress Ninja Forms Plugin Arbitrary Shortcode Execution Vulnerability (CVE-2026-100155)

1. Apply Official Security Patch

Update the Ninja Forms plugin to the latest version via the WordPress admin dashboard or using WP-CLI:

# Update via WP-CLI
wp plugin update ninja-forms

2. Temporary Mitigation (WAF Rule)

If immediate patching is not feasible, deploy a Web Application Firewall (WAF) rule to inspect and block suspicious AJAX requests containing shortcode syntax ([...]):

• Example ModSecurity Rule:

SecRule REQUEST_URI "/wp-admin/admin-ajax.php" "id:100155,phase:2,deny,status:403,log,msg:'Block Ninja Forms Shortcode Injection Attempt',chain"
SecRule ARGS "@rx \[.+\]"

The Ninja Forms plugin for WordPress is vulnerable to arbitrary shortcode execution due to insufficient input validation before passing user-supplied data to the do_shortcode() function.

Specifically, the vulnerability resides within the AJAX submission controllers and merge tag processing components (such as Submission.php, MergeTags.php, and SuccessMessage.php). Because the application fails to sanitize or restrict the values processed during form submission, an unauthenticated attacker can craft requests containing malicious shortcode payloads. When executed by the WordPress core engine, these shortcodes can expose sensitive data, bypass access controls, or chain with other vulnerabilities.