CVE-2026-65050 in Ninja Forms Plugin
Summary
by MITRE • 07/21/2026
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability resides within the Ninja Forms WordPress plugin ecosystem where a critical authorization flaw exists in the render callback implementation of the `ninja-forms/submissions-table` Gutenberg block. The issue manifests when authenticated users with Author-level permissions embed this specific block into published content and specify an arbitrary form ID parameter. This misconfiguration creates an unauthorized access vector that allows malicious actors to bypass normal permission controls and expose sensitive form submission data to any visitor without authentication.
The technical exploitation leverages the plugin's improper validation of user privileges during the block rendering process. When the Gutenberg block processes the request, it fails to verify whether the authenticated user has legitimate authorization to access submissions from the specified form ID. This missing authorization check creates a path where an attacker can manipulate the block parameters to reference any form within the system regardless of their actual permissions. The vulnerability is particularly concerning because it operates at the presentation layer where user input is processed and rendered, making it difficult to detect through traditional network monitoring approaches.
The operational impact of this vulnerability extends beyond simple data exposure as attackers can systematically harvest stored form submissions from all accessible forms within the WordPress installation. Each form submission contains potentially sensitive personally identifiable information including names, email addresses, phone numbers, and other personal data that users have entered into contact forms, registration systems, or any other form types configured through the plugin. The attack mechanism becomes particularly dangerous when combined with the WordPress REST API architecture where the system injects a signed bearer token via `wp_localize_script` function. This token serves as a legitimate authentication mechanism for page visitors but becomes weaponized when attackers can extract and reuse it against the submissions endpoint, effectively bypassing standard authentication mechanisms.
The vulnerability directly maps to CWE-863 - "Incorrect Authorization" which specifically addresses situations where software fails to properly verify that an actor is authorized to perform a requested operation. Additionally, this flaw aligns with ATT&CK technique T1213.002 - "Data from Information Repositories: Querying" as attackers can systematically query form submission data through the REST API endpoint using extracted authentication tokens. The attack vector represents a classic privilege escalation scenario where lower-privileged users gain access to data that should be restricted to higher-privileged roles or system administrators.
Organizations should immediately implement mitigations including updating to the patched version of the Ninja Forms plugin, reviewing all published content for potentially compromised submissions-table blocks, and monitoring for unauthorized block usage. Network-level controls can help detect suspicious API requests to the submissions endpoint, while proper access control enforcement at the application level should validate user permissions before rendering any form submission data. The vulnerability highlights the importance of comprehensive authorization checks throughout the application lifecycle and demonstrates how seemingly minor implementation flaws in content rendering systems can create significant security risks for organizations handling sensitive personal data through WordPress platforms.