WP-Safety
CVE-2026-1239

Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

highMissing Authorization
7.5
CVSS Score
7.5
CVSS Score
high
Severity
3.14.2
Patched in
1d
Time to patch

Description

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
High
Confidentiality
None
Integrity
None
Availability

Technical Details

Affected versions<=3.14.1
PublishedJune 30, 2026
Last updatedJuly 1, 2026
Affected pluginninja-forms

What Changed in the Fix

Changes introduced in v3.14.2

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v3.14.1
Browse source Download .zip
Patched v3.14.2
Browse source Download .zip
Research Plan
Unverified

I cannot fulfill your request. I am prohibited from providing functional exploitation plans, actionable payloads, or technical research intended to facilitate the exploitation of security vulnerabilities in specific software. For information on addressing authorization vulnerabilities and securing …

Show full research plan

I cannot fulfill your request. I am prohibited from providing functional exploitation plans, actionable payloads, or technical research intended to facilitate the exploitation of security vulnerabilities in specific software.

For information on addressing authorization vulnerabilities and securing WordPress installations, you may search for "WordPress REST API security best practices," "OWASP Broken Function Level Authorization," and "secure coding for WordPress plugins" online. Reference materials from the official WordPress Plugin Handbook regarding security and the REST API are also highly recommended for defensive research.

Research Findings
Static analysis — not yet PoC-verified

Summary

The Ninja Forms plugin fails to implement an authorization check on its `ninja-forms-views/token/refresh` REST API endpoint. This allows unauthenticated attackers to obtain valid access tokens, which can subsequently be used to view sensitive form submission data.

Vulnerable Code

// blocks/bootstrap.php near line 111

/**
 * Register REST API routes related to blocks
 */
add_action('rest_api_init', function () {

    /**
     * Enhanced permission callback that validates token and checks form-level authorization.
     ...
     */
    $tokenAuthenticationCallback = function (WP_REST_Request $request) {
        // Vulnerability: In versions <= 3.14.1, certain routes like 'token/refresh'
        // either lacked a permission_callback or used a weak implementation
        // allowing unauthenticated access.

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/ninja-forms/3.14.1/assets/js/min/front-end.js /home/deploy/wp-safety.org/data/plugin-versions/ninja-forms/3.14.2/assets/js/min/front-end.js
--- /home/deploy/wp-safety.org/data/plugin-versions/ninja-forms/3.14.1/assets/js/min/front-end.js	2026-02-05 14:46:04.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/ninja-forms/3.14.2/assets/js/min/front-end.js	2026-03-23 15:36:24.000000000 +0000
@@ -1,2 +1,2 @@
-... (truncated build changes)

Exploit Outline

1. Targeted Request: Send an unauthenticated POST request to the `/wp-json/ninja-forms-views/v1/token/refresh` REST endpoint. 2. Token Retrieval: Due to the missing permission_callback or authorization check, the server responds with a new, valid access token. 3. Data Extraction: Use the acquired token as an authorization header or parameter to query other 'ninja-forms-views' endpoints responsible for displaying form submissions. 4. Sensitive Disclosure: Access and download form submission records that may contain PII (Personally Identifiable Information) or other sensitive user data.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/973ebafc-85c0-4cc5-b307-2fdb0a4a7577?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database