What is the CVSS score of CVE-2025-14072?

CVE-2025-14072 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ninja Forms are affected by CVE-2025-14072?

Organizations using Ninja Forms WordPress should be aware of moderate risk from CVE-2025-14072 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for CVE-2025-14072?

Yes, a public proof-of-concept exploit is available for CVE-2025-14072. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-14072?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ninja Forms CVE-2025-14072

MEDIUM

2026-01-02 contact@wpscan.com

WordPress Ninja Forms PHP

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 09, 2026 - 13:58 vuln.today

Public exploit code

CVE Published

Jan 02, 2026 - 06:15 nvd

MEDIUM 5.3

DescriptionCVE.org

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

AnalysisAI

Ninja Forms versions up to 3.13.3 contains a vulnerability that allows attackers to generate valid access tokens via the REST API which can then be used to read for (CVSS 5.3).

Technical ContextAI

affects Ninja Forms. The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Ninja Forms

View all

CVE-2016-1209 CRITICAL Emergency POC

9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2021-24163 HIGH This Week POC

8.8 Apr 05

The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it ha

CVE-2018-16308 HIGH This Week POC

8.6 Sep 01

The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. Rated high severity (CVSS 8.6), this vulnerab

CVE-2022-2903 HIGH This Week POC

7.2 Sep 26

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could le

CVE-2021-24889 HIGH This Week POC

7.2 Nov 29

The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which coul

CVE-2021-34647 MEDIUM This Month POC

6.5 Sep 22

The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions funct

CVE-2024-7354 MEDIUM This Month POC

6.1 Sep 02

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading

CVE-2023-37979 MEDIUM This Month POC

6.1 Jul 27

Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at

CVE-2023-1835 MEDIUM This Month POC

6.1 May 15

The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it bac

CVE-2021-24165 MEDIUM This Month POC

6.1 Apr 05

In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable

CVE-2018-19796 MEDIUM This Month POC

6.1 Dec 03

An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via

CVE-2018-19287 MEDIUM This Month POC

6.1 Nov 15

XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes

CVE-2025-14072 vulnerability details – vuln.today

Back

Ninja Forms CVE-2025-14072

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Ninja Forms

Share

External POC / Exploit Code