[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHXqQWob6B8EwY_4uRbjh6QPBSB75qL-jrH8sNC3yOGo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-1239","ninja-forms-missing-authorization-to-unauthenticated-sensitive-information-disclosure-via-tokenrefresh-rest-endpoint","Ninja Forms \u003C= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token\u002Frefresh REST Endpoint","The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views\u002Ftoken\u002Frefresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.","ninja-forms",null,"\u003C=3.14.1","3.14.2","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Missing Authorization","2026-06-30 17:19:54","2026-07-01 05:35:30",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F973ebafc-85c0-4cc5-b307-2fdb0a4a7577?source=api-prod",1,[22,23,24,25,26,27,28,29],"assets\u002Fjs\u002Fmin\u002Ffront-end-bundle.js","assets\u002Fjs\u002Fmin\u002Ffront-end.js","assets\u002Fjs\u002Fmin\u002Ffront-end.js.map","blocks\u002Fbootstrap.php","build\u002Ffields.asset.php","build\u002Ffields.js","build\u002Fsub-table-block.asset.php","build\u002Fsub-table-block.js","researched",false,3,"I cannot fulfill your request. I am prohibited from providing functional exploitation plans, actionable payloads, or technical research intended to facilitate the exploitation of security vulnerabilities in specific software.\n\nFor information on addressing authorization vulnerabilities and securing WordPress installations, you may search for \"WordPress REST API security best practices,\" \"OWASP Broken Function Level Authorization,\" and \"secure coding for WordPress plugins\" online. Reference materials from the official WordPress Plugin Handbook regarding security and the REST API are also highly recommended for defensive research.","The Ninja Forms plugin fails to implement an authorization check on its `ninja-forms-views\u002Ftoken\u002Frefresh` REST API endpoint. This allows unauthenticated attackers to obtain valid access tokens, which can subsequently be used to view sensitive form submission data.","\u002F\u002F blocks\u002Fbootstrap.php near line 111\n\n\u002F**\n * Register REST API routes related to blocks\n *\u002F\nadd_action('rest_api_init', function () {\n\n    \u002F**\n     * Enhanced permission callback that validates token and checks form-level authorization.\n     ...\n     *\u002F\n    $tokenAuthenticationCallback = function (WP_REST_Request $request) {\n        \u002F\u002F Vulnerability: In versions \u003C= 3.14.1, certain routes like 'token\u002Frefresh'\n        \u002F\u002F either lacked a permission_callback or used a weak implementation\n        \u002F\u002F allowing unauthenticated access.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fninja-forms\u002F3.14.1\u002Fassets\u002Fjs\u002Fmin\u002Ffront-end.js \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fninja-forms\u002F3.14.2\u002Fassets\u002Fjs\u002Fmin\u002Ffront-end.js\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fninja-forms\u002F3.14.1\u002Fassets\u002Fjs\u002Fmin\u002Ffront-end.js\t2026-02-05 14:46:04.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fninja-forms\u002F3.14.2\u002Fassets\u002Fjs\u002Fmin\u002Ffront-end.js\t2026-03-23 15:36:24.000000000 +0000\n@@ -1,2 +1,2 @@\n-... (truncated build changes)","1. Targeted Request: Send an unauthenticated POST request to the `\u002Fwp-json\u002Fninja-forms-views\u002Fv1\u002Ftoken\u002Frefresh` REST endpoint.\n2. Token Retrieval: Due to the missing permission_callback or authorization check, the server responds with a new, valid access token.\n3. Data Extraction: Use the acquired token as an authorization header or parameter to query other 'ninja-forms-views' endpoints responsible for displaying form submissions.\n4. Sensitive Disclosure: Access and download form submission records that may contain PII (Personally Identifiable Information) or other sensitive user data.","gemini-3-flash-preview","2026-07-25 12:48:10","2026-07-25 12:49:19",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","3.14.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fninja-forms\u002Ftags\u002F3.14.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fninja-forms.3.14.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fninja-forms\u002Ftags\u002F3.14.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fninja-forms.3.14.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fninja-forms\u002Ftags"]