EUVD-2026-45128
GHSA-c8hw-hm2h-46fp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible export endpoint requires only subscriber-level auth (PR:L); C:L reflects application-layer form data exposure with no integrity or availability impact and no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate any Ninja Forms form ID and download all stored submission data - including names, email addresses, phone numbers, physical addresses, and any other PII collected by site forms - as a downloadable XLSX file.
AnalysisAI
Subscriber-level WordPress users can exfiltrate complete PII datasets from all Ninja Forms submissions site-wide in Ninja Forms - Excel Export versions up to and including 3.3.6 by supplying arbitrary values to the spreadsheet_export_form_id parameter, which lacks authorization validation at the export endpoint. The missing access control enables horizontal privilege escalation across all form IDs on the installation, delivering names, email addresses, phone numbers, physical addresses, and any other collected PII as downloadable XLSX files to low-privileged users who should have no cross-form access. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the low attack complexity (AC:L, no user interaction required beyond subscriber-level credentials) makes this a meaningful data privacy risk on WordPress sites with open user registration.
Technical ContextAI
The Ninja Forms - Excel Export plugin (CPE: cpe:2.3:a:saturdaydrive:ninja_forms_-_excel_export) extends the Ninja Forms WordPress form builder with XLSX export functionality. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key): the export handler at ninja-forms-excel-export.php line 187 accepts the user-supplied spreadsheet_export_form_id parameter and processes it to retrieve and package form submission data without verifying whether the requesting user holds any authorization over the specified form object. This is a textbook IDOR pattern - the application treats the integer form ID as an implicit access credential rather than enforcing a permission check against WordPress capability or ownership records. Because WordPress form IDs are sequential integers, enumeration is trivial and requires no prior knowledge of form structure.
RemediationAI
No vendor-released patched version has been confirmed from available data; monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/783ccf21-db16-4aac-9a3c-992b3aac5526 and the WordPress plugin repository for an updated release. The most effective immediate compensating control is to deactivate or uninstall the Ninja Forms - Excel Export plugin entirely, which eliminates the vulnerable export endpoint at the cost of XLSX export functionality for all users. If deactivation is not operationally feasible, disable open user self-registration on the WordPress site to prevent unauthenticated parties from acquiring subscriber accounts, noting this blocks new user self-service as a trade-off. Additionally, audit all subscriber-level accounts and remove any that are not explicitly authorized. As a data minimization measure, review Ninja Forms submission retention settings and purge stored PII that is no longer operationally needed, reducing the value of any exfiltration that may have already occurred.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today