PT-2026-54501 · Kstover · Ninja Forms – The Contact Form Builder That Grows With You

Suyoung Kim · Publicado 2026-07-01 · Atualizado 2026-07-01 · CVE-2026-1239

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1239

Produtos afetados

Ninja Forms – The Contact Form Builder That Grows With You

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-1239 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/973ebafc-85c0-4cc5-b307-2fdb0a4a7577?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3489168/ninja-forms · Nota