CVE-2026-15663 Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key

🗓️ 24 Jul 2026 09:31:46Reported by WordfenceType

Authenticated administrators can inject database queries via the settings key during Ninja Forms import (<=3.14.9) to extract data.

Reporter	Title	Published	Views	Family All 6
ATTACKERKB	CVE-2026-15663	24 Jul 202609:31	–	attackerkb
CVE	CVE-2026-15663	24 Jul 202609:31	–	cve
EUVD	EUVD-2026-48549	24 Jul 202609:31	–	euvd
NVD	CVE-2026-15663	24 Jul 202610:16	–	nvd
Positive Technologies	PT-2026-64272	24 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-15663 Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key	24 Jul 202609:31	–	vulnrichment

[
  {
    "vendor": "kstover",
    "product": "Ninja Forms – The Contact Form Builder That Grows With You",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.14.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.9/includes/Abstracts/Model.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.9/includes/AJAX/REST/BatchProcess.php
plugins	www.plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.9/includes/Admin/Menus/ImportExport.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2fda47d8-8e8c-4103-aabb-c70935e13450
plugins	www.plugins.trac.wordpress.org/browser/ninja-forms/tags/3.14.9/includes/Admin/Processes/ImportForm.php

24 Jul 2026 09:31Current

CVSS 3.14.9

CWE-89