PT-2026-7248 · WordPress+1 · Ninja Forms+1

Johska · Published 2026-02-10 · Updated 2026-02-11 · CVE-2026-2268

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ninja Forms versions prior to 3.14.1

Description The Ninja Forms plugin for WordPress is susceptible to Sensitive Information Exposure in versions up to and including 3.14.0. This occurs because the ninja forms merge tags filter is applied unsafely to user-provided input within repeater fields, allowing the resolution of {post meta:KEY} merge tags without proper authorization. This enables unauthenticated attackers to retrieve arbitrary post metadata from any post on the site. The issue is exploitable via the nf ajax submit API endpoint and can expose sensitive data like WooCommerce billing emails, API keys, private tokens, and customer personal information.

Recommendations Update Ninja Forms to version 3.14.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-2268

Affected Products

Ninja Forms

Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2268 · Security Note
• https://plugins.trac.wordpress.org/changeset/3454719/ninja-forms/trunk/includes/AJAX/Controllers/Submission.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/24902fab-44ea-44c9-bcf5-70960cfeb402?source=cve · Note
• https://twitter.com/RedPacketSec/status/2021462519789838831 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.13.3/includes/AJAX/Controllers/Submission.php#L222 · Note
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.13.3/includes/MergeTags/WP.php#L48 · Note
• https://t.me/CVEtracker/44304 · Telegram Post
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.13.3/includes/AJAX/Controllers/Submission.php#L706 · Note