What is the CVSS score of CVE-2026-1239?

CVE-2026-1239 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Ninja Forms are affected by CVE-2026-1239?

Ninja Forms WordPress plugin (versions through 3.14.1) contains a broken access control vulnerability in its REST API that allows unauthenticated attackers to retrieve stored form submissions…

How to fix or mitigate CVE-2026-1239?

Within 24 hours: Audit all WordPress installations for Ninja Forms presence and versions; immediately deactivate the plugin and export form submission database for security review. Within 7 days: Analyze web server access logs for suspicious requests to '/ninja-forms-views/token/refresh' endpoint to determine if exploitation has occurred; initiate customer notification and credit monitoring if unauthorized access is confirmed. Within 30 days: Complete migration to alternative form plugin (WPForms, Gravity Forms, or Formidable Forms) with security audit, or implement permanent WAF rule blocking the vulnerable endpoint if operational constraints require delay.

Ninja Forms CVE-2026-1239

EUVD-2026-40913 HIGH

Missing Authorization (CWE-862)

2026-07-01 Wordfence

GHSA-28rc-qxcc-hgg9

WordPress Authentication Bypass Ninja Forms The Contact Form Builder That Grows With You Wordpress Plugin Kstover

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network REST request (AV:N/AC:L/PR:N/UI:N) discloses stored submissions with no integrity or availability impact, so C:H and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 07:16 vuln.today

CVE Published

Jul 01, 2026 - 05:35 cve.org

HIGH 7.5

DescriptionCVE.org

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 2 Critical, 14 High, 4 With POC Jul 02, 2026

AnalysisAI

Broken access control in the Ninja Forms WordPress plugin (all versions through 3.14.1) lets unauthenticated remote attackers read stored form submissions via the 'ninja-forms-views/token/refresh' REST callback, which lacks an authorization check. Because Ninja Forms submissions frequently capture PII, contact details, and other sensitive user-entered data, this exposes potentially confidential information to anyone who can reach the site. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-auth nature makes it straightforward to abuse.

Technical ContextAI

Ninja Forms is a widely used drag-and-drop contact/form builder for WordPress that stores user submissions in the WordPress database and exposes functionality through the WordPress REST API. The flaw is a CWE-862 Missing Authorization: the REST route registered at 'ninja-forms-views/token/refresh' (part of the plugin's Views/token-refresh feature) executes its callback without verifying the caller's identity or capabilities via a permission_callback. In WordPress, REST endpoints must enforce authorization in their permission_callback; when that check is absent or returns true unconditionally, any HTTP client can invoke the handler. The affected package is identified by CPE cpe:2.3:a:kstover:ninja_forms_-_the_contact_form_builder_that_grows_with_you (vendor kstover), covering all releases up to and including 3.14.1.

RemediationAI

Upgrade Ninja Forms to the first release after 3.14.1 that includes the authorization fix committed in plugins.trac changeset 3489168 (https://plugins.trac.wordpress.org/changeset/3489168/ninja-forms); the input does not state an exact fix version number, so confirm the current patched release (3.14.2 or later) on the plugin page before deploying and review the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/973ebafc-85c0-4cc5-b307-2fdb0a4a7577. If immediate patching is not possible, restrict access to the WordPress REST API path for the plugin - for example, block or require authentication on '/wp-json/ninja-forms-views/token/refresh' at the web server or WAF layer (Wordfence firewall rules cover this), with the trade-off that overly broad REST filtering can break legitimate front-end form rendering. As a stronger interim control, disable the Ninja Forms Views/submissions feature if it is not in use, accepting loss of that functionality until the update is applied.