Sensitive Information Exposure in Ninja Forms Plugin for WordPress
CVE-2026-1307

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Ninja Forms – The Contact Form Builder That Grows With You
Vendor
CVE Published:
28 March 2026

What is CVE-2026-1307?

The Ninja Forms plugin for WordPress is susceptible to a serious vulnerability that allows authenticated users with Contributor-level access and above to exploit a callback function within the admin_enqueue_scripts action handler located in blocks/bootstrap.php. This issue enables these attackers to access sensitive information, specifically an authorization token that can reveal form submissions across arbitrary forms. The vulnerability affects all versions of the plugin up to and including version 3.14.1, posing a significant risk to data integrity and user privacy.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Ninja Forms – The Contact Form Builder That Grows With You * <= 3.14.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3489168/ninj...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucas Montes
JSON
.