Ninja Forms CVE-2025-11924

Requires the target site to render the Ninja Forms Submissions Table block on a page the attacker can load, since that block leaks the bearer token used to authorize the ninja-forms-views REST endpoints; with that token an unauthenticated remote attacker can read arbitrary form definitions and submission records. The primary limiting factor is that a site not using the Submissions Table block does not leak the token. Additionally, installs that applied only the incomplete 3.13.1 patch remain exploitable because that version introduced an endpoint that mints valid bearer tokens for arbitrary form IDs; the flaw impacts Ninja Forms versions up to and including 3.13.2.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated confidentiality-only flaw, and this aligns well with the CWE-639 IDOR description: unauthenticated attackers can read arbitrary form definitions and submission records. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so exploitation is 'no public exploit identified at time of analysis' - this is a Wordfence-catalogued authorization flaw, not confirmed active exploitation. The realistic risk is moderate rather than acute: the PR:N rating is technically justified (the attacker need not authenticate), but real exploitation depends on a bearer token being leaked to a page rendering the Submissions Table block, which is a meaningful precondition the raw CVSS PR:N does not capture. Notably, the description flags a defective earlier fix (3.13.1 introduced an endpoint that could mint a valid bearer token for arbitrary form IDs), so incompletely-patched installs are effectively still exposed - defenders must confirm they are on the corrected patch (trac changeset 3415563), not merely 3.13.1. Given the plugin's very large install base, this is a real prioritize-and-patch issue despite the absence of active-exploitation signals.

An attacker browses to any front-end WordPress page that embeds the Ninja Forms Submissions Table block, harvests the bearer token leaked into that page, and replays it against the ninja-forms-views REST endpoints to enumerate form definitions and dump submission records (names, emails, and any collected PII) for arbitrary form IDs. No account or user interaction is required. No public exploit code is identified in the input, but the mechanism is straightforward and well-documented by the Wordfence advisory.