CVE-2026-92438

Summary

The flaw allows unauthenticated users to inject malicious code into form submissions, which could then be executed in the browser of an admin user reviewing the submission, leading to potential remote code execution.

Exploitability

Exploitation is relatively straightforward as it requires submitting a form with malicious content, which can then be executed by an admin viewing the submission. Precondition is that the admin has access to the submission edit screen.

Blast radius

If exploited, the impact could be severe, as it allows for remote code execution in the context of an admin user, potentially leading to full control over the affected WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Ninja Forms version 3.15.4 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.