Patch Ninja Forms 3.15.6: three newly published WordPress CVEs to assess

Status at 1 November 2026: Reported by the CVE records; no CISA KEV listing was found during this review and no public active exploitation claim is included here. Urgency: high for public forms. The published records describe three related issues in Ninja Forms through 3.15.5. Update to 3.15.6, then check your public forms and administrative access.

At a glance

CVSS describes technical impact, not your business priority. A public contact, registration or payment-related form raises priority because anonymous visitors can reach it. The WordPress plugin directory and the referenced changeset identify 3.15.6 as the patched tag.

What is confirmed — and what is not

The NVD records state that CVE-2026-100155 permits unauthenticated arbitrary shortcode execution through affected Ninja Forms versions. CVE-2026-101326 is a related shortcode path requiring at least Subscriber access and a specific public form configuration using the WordPress display-name merge tag. CVE-2026-109997 is stored cross-site scripting in form data; the record describes a public submission path in the affected release.

These are vulnerability reports, not evidence that a particular site has been compromised. This review found no CISA KEV entry and makes no claim of active exploitation. Do not test by submitting crafted payloads: version, configuration and log evidence are safer and sufficient for triage.

Are you affected?

You are in scope when all of the following are true:

1. Your WordPress installation has the Ninja Forms plugin active.
2. Its installed version is 3.15.5 or earlier.
3. At least one form can be reached by people outside the intended administrative boundary. For CVE-2026-101326, also review forms whose default field value uses the WordPress user display-name merge tag.

Safe checks

WordPress dashboard: sign in as an administrator, open Plugins → Installed Plugins, locate Ninja Forms, and record the version and whether it is active. Expected result: version 3.15.6 means the reported version range does not apply; 3.15.5 or lower requires remediation.

WP-CLI, on the site you administer:

wp plugin list --name=ninja-forms --fields=name,status,version,update,update_version

Expected result: preserve the output in your change ticket. A version at or below 3.15.5 is affected by the published range. “Inactive” does not prove safety if the plugin files remain deployed, but it removes the normal public form path; remove unused plugins after a backup and change review.

Configuration review: in Ninja Forms → Dashboard, list forms and note each form’s page, public visibility and submission method. In the builder, inspect default values for WordPress user display-name merge tags. This identifies exposure; it does not prove exploitation.

Evidence to retain: a dated plugin inventory, the before/after version, a list of public form URLs, and relevant web or application logs. Do not upload form exports containing personal data to third parties.

Patch now, with a reversible change

Prerequisites

Take a database backup and a copy of the current site files through your normal host or backup tool. Confirm a recent restore point, schedule the change outside a critical registration window, and ensure you can reach a break-glass WordPress administrator account. If the site uses a cache, CDN or deployment pipeline, identify its purge and rollback procedure first.

Dashboard path

1. Open Dashboard → Updates or Plugins → Installed Plugins.
2. Find Ninja Forms and select Update now. Do not download a replacement ZIP from an unverified source.
3. Wait for WordPress to report that the update completed.
4. Purge the site and application caches using the approved site procedure.
5. As an unauthenticated visitor, submit a harmless test form to a test mailbox or test workflow. Do not use customer data.
6. In Ninja Forms → Submissions, confirm the test arrives and any normal notification or integration works.

Expected result: the plugin reports 3.15.6 and ordinary form submission continues. Validation is about normal business function; it is not an exploit test.

WP-CLI path

Run this only on the WordPress instance you operate and after the backup:

wp plugin update ninja-forms --version=3.15.6
wp plugin list --name=ninja-forms --fields=name,status,version,update

Expected result: the second command reports version 3.15.6. Re-run a normal test submission and check the web server/PHP error log for new errors.

Rollback: if the update causes a confirmed service regression, restore the tested pre-change site backup or deploy the prior approved release through your normal release process. Do not leave 3.15.5 publicly exposed while investigating: temporarily disable public forms, put affected pages behind authentication, or use a maintenance route that preserves a support contact. Record the decision, owner and duration.

Interim containment when you cannot patch immediately

The vendor-supported corrective action is the updated plugin version. Until that is deployed, reduce exposure rather than attempting an unverified code workaround:

• Disable or unpublish public Ninja Forms pages where business operations allow it.
• Restrict registration and other untrusted submission surfaces; remove Subscriber accounts that are no longer needed after checking ownership.
• Review the affected forms for display-name merge-tag defaults and replace that design only after testing in a staging site.
• Review recent form submissions, WordPress administrator events and web logs for unexpected changes around public forms. Absence of suspicious entries is not proof that no exploitation occurred.
• Preserve logs and a copy of relevant submissions before making broad changes, subject to your privacy and retention rules.

A WAF rule or generic script filter is not a substitute for the vendor fix and is not presented here as a vendor-confirmed mitigation.

Safe external exposure check

If you use NetTools.tech DNS Lookup, enter only a domain you own, for example forms.example.com. Expected result: the tool returns the public DNS records and IP address used to reach the site. This can help inventory public form hosts, but it cannot determine whether Ninja Forms is installed, which version is running, whether a form is public, or whether any CVE was exploited. Do not perform active scans of systems without authorisation.

Practical priority

Patch first where anonymous visitors can submit forms, where staff use administrator sessions in the same browser context, or where form submissions trigger payment, account or workflow actions. The EPSS values above are a dated probability signal, not a clearance to defer remediation. A small percentage is not a guarantee of safety; the public reachability and business workflow make the local decision.

Timeline

• 31 October 2026: NVD published CVE-2026-100155, CVE-2026-101326 and CVE-2026-109997.
• 1 November 2026: this article checked the NVD records, FIRST EPSS data dated 31 October, the WordPress plugin directory and the 3.15.6 changeset. No KEV listing or active-exploitation confirmation was identified in this review.

References

1. NVD: CVE-2026-100155 — https://nvd.nist.gov/vuln/detail/CVE-2026-100155
2. NVD: CVE-2026-101326 — https://nvd.nist.gov/vuln/detail/CVE-2026-101326
3. NVD: CVE-2026-109997 — https://nvd.nist.gov/vuln/detail/CVE-2026-109997
4. WordPress.org: Ninja Forms plugin directory — https://wordpress.org/plugins/ninja-forms/
5. WordPress Plugin Trac: Ninja Forms 3.15.5 to 3.15.6 changeset — https://plugins.trac.wordpress.org/changeset?reponame=&new=3749135%40ninja-forms%2Ftags%2F3.15.6&old=3717122%40ninja-forms%2Ftags%2F3.15.5
6. FIRST EPSS API, retrieved 1 November 2026 — https://api.first.org/data/v1/epss

Izmaiņu žurnāls

• 1 November 2026, r1: Initial publication; recorded CVE publication dates, affected range, fixed tag, dated EPSS and no confirmed exploitation/KEV status at review time.