PT-2026-54501 · Kstover · Ninja Forms – The Contact Form Builder That Grows With You

Suyoung Kim · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-1239

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1239

Affected Products

Ninja Forms – The Contact Form Builder That Grows With You

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-1239 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/973ebafc-85c0-4cc5-b307-2fdb0a4a7577?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3489168/ninja-forms · Note