PHP CVE-2026-1307

The CVSS 3.1 base score of 6.5 reflects a medium-to-high severity issue with network attack vector, low complexity, and high confidentiality impact. The requirement for PR:L (Contributor-level privileges) restricts the immediate threat surface, as attackers must first obtain legitimate WordPress user credentials at Contributor level or higher. However, the high confidentiality impact (C:H) is significant because form submissions frequently contain personally identifiable information, email addresses, phone numbers, and other sensitive data. The EPSS score and real-world exploit probability are not confirmed from provided data, but the simplicity of token exfiltration (likely accessible via unauthenticated or low-privilege script inspection) suggests practical exploitability. This is a legitimate priority for WordPress site administrators, particularly those using Ninja Forms to collect sensitive information, though it is less critical than unauthenticated remote code execution vulnerabilities. The requirement for authenticated access limits mass exploitation but increases insider threat risk.

An attacker with WordPress Contributor-level credentials (obtained through credential compromise, social engineering, or intentionally granted access by a site administrator) logs into the WordPress admin panel and inspects the source code or network traffic of the Ninja Forms admin pages. The attacker extracts the exposed authorization token from the blocks/bootstrap.php callback function, then uses this token to programmatically access form submissions from any form in the WordPress installation, exfiltrating potentially sensitive customer inquiries, lead information, or personal data without detection by the form owner. The low complexity of the attack (simple token extraction and API access) makes this exploitable by non-sophisticated actors with basic WordPress knowledge.