Which versions of Ninja Forms are affected by CVE-2026-65050?

Ninja Forms WordPress plugin versions 3.14.8 and earlier contain a broken authorization vulnerability allowing authenticated site administrators to inadvertently expose stored form…. A patch is available.

How to fix or mitigate CVE-2026-65050?

Within 24 hours, identify all WordPress installations using Ninja Forms plugin and document current versions; restrict Author-level user permissions to trusted administrators only and audit all published posts containing Ninja Forms blocks for unintended data exposure. Within 7 days, upgrade all affected Ninja Forms installations to the patched version provided by the vendor-conduct testing on staging environments to verify compatibility with existing forms and submissions before deploying to production. Within 30 days, audit all published content to remove or properly configure Ninja Forms submission blocks, review web server access logs for unauthorized REST API submissions endpoint requests, and implement role-based capability controls to further restrict which user roles can publish embedded forms.

Ninja Forms CVE-2026-65050

Q: What is the CVSS score of CVE-2026-65050?

CVE-2026-65050 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46270 HIGH

Missing Authorization (CWE-862)

2026-07-21 VulnCheck

GHSA-q35h-52xj-jfcj

WordPress Authentication Bypass Ninja Forms Wordpress Plugin Saturday Drive

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Author-level access is needed to plant the block (PR:L) but the leaked token then discloses data to unauthenticated visitors, crossing a trust boundary (S:C); confidentiality-only impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 15:03 vuln.today

CVE Published

Jul 21, 2026 - 14:26 cve.org

HIGH 7.1

DescriptionCVE.org

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the ninja-forms/submissions-table Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via wp_localize_script and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026

AnalysisAI

Broken authorization in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets an authenticated Author-level user expose stored form submissions to any unauthenticated site visitor by embedding the ninja-forms/submissions-table Gutenberg block with an arbitrary formID on a published post. Because the block's render callback performs no capability check and injects a signed bearer token into every visitor's browser via wp_localize_script, anyone loading the page can replay that token against the REST submissions endpoint and read all saved field values, including PII such as names, emails, and phone numbers. Reported by VulnCheck; a vendor patch is available, but no public exploit code was identified at time of analysis and the flaw is not in CISA KEV - no public exploit identified at time of analysis.

Technical ContextAI

Ninja Forms is a widely used drag-and-drop form builder plugin for WordPress that stores submitted form data in the site database and exposes it through a WordPress REST API submissions endpoint gated by a signed bearer token. The vulnerability lives in the server-side render callback of the plugin's ninja-forms/submissions-table Gutenberg block: the callback renders the block and calls wp_localize_script to inject a valid signed bearer token into the page's JavaScript for every viewer, but never verifies that the current viewer is authorized to see submissions for the requested formID. This maps to CWE-862 (Missing Authorization) - the root cause is an authorization decision that is simply absent at the block-render and token-issuance layer, so an authorization-sensitive token is handed to unauthenticated clients. The affected product per CPE is cpe:2.3:a:saturday_drive:ninja_forms:*:*:*:*:*:*:*:* (vendor Saturday Drive), covering all versions up to and including 3.14.8.

RemediationAI

Patch available per vendor advisory - upgrade Ninja Forms to the fixed release above 3.14.8; consult the plugin changelog at https://wordpress.org/plugins/ninja-forms/changelog/ for the exact patched version (the input does not name a specific fix version, so verify it there before deploying) and review the VulnCheck advisory at https://www.vulncheck.com/advisories/ninja-forms-missing-authorization-in-submissions-table-gutenberg-block-discloses-form-submissions-to-unauthenticated-visitors. Until you can update, tighten who holds Author-and-above roles and audit published posts for any embedded ninja-forms/submissions-table block referencing formIDs the author should not access, unpublishing or removing offending blocks. As additional compensating controls you can restrict the plugin's REST submissions endpoint at the web server or WAF layer to authenticated admin sessions only (side effect: may break legitimate front-end submission-table displays) and audit new post publications by lower-privilege authors; these are stopgaps and do not replace the upgrade.