CVE-2026-15663: Ninja Forms WordPress Plugin SQLi Flaw

CVE-2026-15663 Overview

CVE-2026-15663 is a SQL injection vulnerability in the Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress. The flaw affects all versions up to and including 3.14.9. The vulnerability stems from insufficient escaping of user-supplied keys within the settings object of import files, combined with unprepared SQL queries. Authenticated attackers with administrator-level access can append arbitrary SQL to existing queries and extract sensitive database contents. The vulnerable data path bypasses wp_magic_quotes protections entirely because the payload arrives through file_get_contents() or base64-decoded and JSON-decoded blobs.

Critical Impact
Authenticated administrators can execute arbitrary SQL statements against the WordPress database, enabling extraction of user credentials, session tokens, and other sensitive stored data through two distinct sinks in the plugin.

Affected Products

Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress
All versions up to and including 3.14.9
WordPress installations with administrator accounts capable of importing forms

Discovery Timeline

2026-07-24 - CVE CVE-2026-15663 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-15663

Vulnerability Analysis

The vulnerability is a generic SQL injection classified under [CWE-89]. It exists in the import handling path of Ninja Forms and affects two distinct sinks: _save_setting() in Model.php and insert_form_meta() in ImportForm.php. In both cases, only the value side of the settings pair is escaped, while the key side receives no sanitization or parameterization anywhere in the call chain.

An authenticated administrator uploads a crafted import file. The plugin processes the file through file_get_contents() or via base64-decoded and JSON-decoded blobs. Because the payload never traverses the standard request pipeline, wp_magic_quotes protections do not apply. Attacker-controlled keys inside the settings object flow directly into SQL statements, allowing appended queries that read data from the WordPress database.

The attack requires administrator privileges, which limits mass exploitation, but the impact is high confidentiality loss. Successful exploitation exposes the wp_users table, secrets in wp_options, and any other data reachable through the WordPress database user.

Root Cause

The root cause is a lack of parameterization or sanitization on associative array keys derived from user-supplied import data. Developers escaped the value portion of each key-value pair but assumed the keys themselves were trusted. Because keys are concatenated into SQL statements, an attacker who controls the JSON structure of the import file also controls part of the query text.

Attack Vector

Exploitation requires an authenticated session with administrator-level access and above. The attacker uploads a malicious Ninja Forms import file containing crafted keys inside the settings object. The plugin loads the file, base64-decodes and JSON-decodes the payload, then passes the attacker-controlled keys into _save_setting() or insert_form_meta(). The unescaped keys are concatenated into SQL statements, executing appended queries against the database.

Code-level details for the affected sinks are available in the plugin source at includes/Abstracts/Model.php line 714 and includes/Admin/Processes/ImportForm.php line 357. See the Wordfence Vulnerability Report and the WordPress Ninja Forms Changeset for the fix diff.

Detection Methods for CVE-2026-15663

Indicators of Compromise

Unexpected calls to the Ninja Forms import endpoint from administrator sessions that do not normally perform imports.
Import files containing SQL metacharacters or subqueries inside JSON key names within the settings object.
Web server logs showing POST requests to the Ninja Forms ImportExport or BatchProcess REST routes followed by anomalous database read volume.
New or modified rows in wp_nf3_form_meta with keys containing SQL fragments.

Detection Strategies

Inspect WordPress audit logs for nf_import actions performed by administrator accounts and correlate with subsequent database access spikes.
Deploy a Web Application Firewall rule that inspects Ninja Forms import payloads for SQL keywords appearing inside JSON keys, not just values.
Monitor MySQL general or slow query logs for statements referencing nf3_form_meta that contain UNION, SLEEP, or subselects.

Monitoring Recommendations

Alert on any Ninja Forms import operation and require manual review of the file contents before processing.
Track administrator account activity for anomalous behavior such as importing forms outside business hours.
Enable and forward WordPress and MySQL logs to a centralized platform for correlation and long-term retention.

How to Mitigate CVE-2026-15663

Immediate Actions Required

Update the Ninja Forms plugin to a version later than 3.14.9 as soon as the patched release is available from the vendor.
Audit all WordPress administrator accounts and remove or downgrade any that do not require elevated privileges.
Enforce multi-factor authentication for every administrator account to reduce the risk of credential-based compromise.
Review recent form imports and inspect wp_nf3_form_meta for suspicious keys.

Patch Information

The vendor addressed the issue in the changeset referenced by WordPress Ninja Forms Changeset. Administrators should upgrade to the fixed release once available and verify the plugin version reported in the WordPress admin dashboard.

Workarounds

Disable the Ninja Forms import functionality until the plugin is upgraded, either by removing access to the import screen or by restricting the plugin to non-administrator users through file permissions.
Restrict administrator access to trusted IP ranges using web server or WAF controls.
Deploy a virtual patch at the WAF layer to reject import payloads that contain SQL syntax inside JSON keys.

bash

# Example WAF rule concept to block SQL metacharacters in JSON keys of Ninja Forms imports
# Adapt to your WAF's syntax before deployment
SecRule REQUEST_URI "@contains /wp-json/ninja-forms" \
  "phase:2,deny,status:403,\
   chain,msg:'Potential CVE-2026-15663 exploit attempt'"
  SecRule REQUEST_BODY "@rx \"[^\"]*(union|select|sleep|--|/\\*)[^\"]*\"\\s*:" "t:lowercase"