Ninja Forms Scheduled Exports CVE-2026-87870

Exploitation requires: (1) an authenticated WordPress user account at subscriber level or above - the lowest default role, assigned automatically on open-registration sites; (2) the Ninja Forms - Scheduled Exports plugin to be installed and active on the target site at version 3.0.3 or earlier; (3) a victim user (typically an admin) to visit a page that renders the stored export configuration containing the injected payload. Exploitation is limited by the requirement for at least a subscriber account (unavailable on sites with registration fully closed), the need for a victim page visit to trigger script execution, and the plugin being a premium paid add-on with a narrower install base than the core Ninja Forms plugin. The REST endpoint's missing permission_callback means capability checks are absent, but nonce validation is still enforced, confirming that unauthenticated exploitation is not possible.

The provided CVSS 6.4 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects network-accessible exploitation at low privilege with scope change into victim browsers. The UI:N metric is arguably optimistic for stored XSS, which classically requires a victim to visit the injected page (warranting UI:R); this is flagged in confidence notes. Real-world risk is primarily shaped by the privilege bar: WordPress subscriber is the role assigned to anyone who self-registers, so any site with open registration is exploitable without any elevated access. The S:C (scope changed) metric correctly reflects that the payload's impact lands in administrators' or other users' browser sessions, enabling session token theft, credential harvesting, or admin action hijacking. No KEV listing and no public POC lower urgency somewhat, but even a mid-sized municipal IT team in olsztyn running a WordPress site with open registration should treat this as a meaningful remediation priority given how low the entry threshold is. The permission_callback gap is an aggravating factor: if nonce leakage were achievable through other means, the exploitable surface could expand beyond authenticated users.

An attacker registers a free subscriber account on a WordPress site with open registration, then sends a crafted REST API POST request to the scheduled-exports endpoint with a malicious JavaScript payload embedded in the emailTo or format parameter. The payload is stored in the database without sanitization; when a site administrator later visits the export management page, the script executes in their browser session, enabling the attacker to exfiltrate the admin's authentication cookie or perform privileged WordPress actions on their behalf. No public POC exists at time of analysis, but the attack requires only basic HTTP tooling and a valid nonce, making it straightforward to reproduce.