EUVD-2026-70907
GHSA-px74-7f5f-fv49
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
AC:H captures the mandatory precondition of admin-assigned capability delegation; PR:L for authenticated low-priv user; C:L for form-data read and I:H for config overwrite and arbitrary post creation.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
AnalysisAI
Improper access control in Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1) allows any user holding a plugin-specific capability to exploit overly permissive REST API endpoints well beyond their intended scope. An attacker authenticated with that capability can read all stored form submissions and plugin settings, overwrite the plugin's configuration, and create or modify arbitrary WordPress posts and pages - operations ordinarily reserved for site administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two explicit preconditions must both be true for exploitation to succeed: the site must run Ninja Forms version 3.14.0 through 3.15.1, and a site administrator must have explicitly assigned the plugin-specific Ninja Forms capability to at least one non-admin WordPress user account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N scores 5.9 (Medium), and the metric choices are sound: AC:H correctly reflects the mandatory precondition that a site administrator must have explicitly assigned the plugin-specific capability to a non-admin account, which WordPress and Ninja Forms both leave undone by default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Ninja Forms to version 3.15.2 or later, which is the vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/befced17-95ff-4809-ad13-f63bc60e5670/ and EUVD-2026-70907. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ninja Forms
View allThe Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it ha
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. Rated high severity (CVSS 8.6), this vulnerab
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could le
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which coul
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions funct
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it bac
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today