Ninja Forms CVE-2026-1239

The specific prerequisite is that the target runs the Ninja Forms plugin (version ≤ 3.14.1) with the REST route 'ninja-forms-views/token/refresh' reachable - this is part of the plugin's default REST registration, so no non-default configuration is needed. Per the CVSS vector (PR:N/UI:N/AC:L), exploitation is unauthenticated, requires no user interaction, and is low complexity. The practical limiting factors are: the plugin and its Views/submission functionality must be active, the site must have stored form submissions for there to be data to disclose, and the endpoint must not be blocked by a WAF or REST-API restriction; there is no platform or version-specific gating beyond the affected version range.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) is internally consistent with the description: network vector, low complexity, no privileges, no user interaction, and a confidentiality-only impact - matching an unauthenticated data-disclosure bug with no integrity or availability effect. No EPSS score, KEV entry, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation. The realistic risk is meaningful because the barrier to exploitation is low (single unauthenticated REST request) and the plugin is popular, but impact is bounded to reading submission data rather than site takeover. Note the confidentiality rating is C:H even though only submitted form data is exposed - this is defensible when forms collect sensitive PII but may overstate risk for sites collecting only trivial data; assess based on what your forms actually capture.

An attacker enumerates WordPress sites running Ninja Forms and sends an unauthenticated HTTP request to the '/wp-json/ninja-forms-views/token/refresh' REST endpoint, which returns form submission data without any authorization check. The attacker harvests submitted PII (names, emails, messages, and any custom fields) from targeted sites at scale. No POC is referenced in the input, but the low-complexity, no-auth vector makes scripted mass collection trivial.