CVE-2026-65050
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
- Score
- CVSS 4.0 7.1 High
- Status
- Deferred - disclosure@vulncheck.com
- Published
- 2026-07-21
- Last modified
- 2026-10-24
- Weaknesses
- CWE-862
Affected products
References
- https://wordpress.org/plugins/ninja-forms/
- https://wordpress.org/plugins/ninja-forms/changelog/
- https://www.vulncheck.com/advisories/ninja-forms-missing-authorization-in-submissions-table-gutenberg-block-discloses-f…
