What is the CVSS score of CVE-2026-2268?

CVE-2026-2268 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2268?

The Ninja Forms WordPress plugin contains an authentication bypass vulnerability that allows unauthenticated attackers to extract sensitive post metadata from your organization's website, potentially…

How to fix or mitigate CVE-2026-2268?

Within 24 hours: Identify all WordPress sites using Ninja Forms and document current versions; assess whether repeater fields containing sensitive data are active. Within 7 days: Implement WAF rules to block requests containing merge tag patterns ({post_meta:*}); consider disabling the Ninja Forms plugin if not business-critical, or disable repeater fields if feasible. Within 30 days: Monitor the Ninja Forms project for patch release; evaluate alternative form plugins with stronger access controls; conduct data exposure audit to determine if metadata was accessed.

WordPress CVE-2026-2268

HIGH

Information Exposure (CWE-200)

2026-02-10 security@wordfence.com

WordPress Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 10:16 nvd

HIGH 7.5

DescriptionCVE.org

The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the ninja_forms_merge_tags filter to user-supplied input within repeater fields, which allows the resolution of {post_meta:KEY} merge tags without authorization checks. This makes it possible for unauthenticated attackers to extract arbitrary post metadata from any post on the site, including sensitive data such as WooCommerce billing emails, API keys, private tokens, and customer personal information via the nf_ajax_submit AJAX action.

AnalysisAI

Unauthenticated attackers can extract arbitrary post metadata from WordPress sites running Ninja Forms plugin versions up to 3.14.0 through improper merge tag filtering in repeater fields, potentially exposing sensitive data like API keys, billing information, and customer details. The vulnerability is exploitable remotely without authentication via the nf_ajax_submit AJAX action and currently lacks a patch.

Technical ContextAI

This vulnerability (CWE-200: Information Exposure) affects Ninja Forms (WordPress plugin). The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the ninja_forms_merge_tags filter to user-supplied input within repeater fields, which allows the resolution of {post_meta:KEY} merge tags without authorization checks. This makes it possible for unauthenticated attackers to extract arbitrary post metadata from any post on the site, including sensitive data such as WooComm