High · published December 17, 2025
⚡ A sneaky direct object reference flaw means unauthenticated attackers can access sensitive data in Ninja Forms! 📄 Think of it as a restaurant where anyone can waltz into the back kitchen and peek at the recipes and orders without needing a chef's hat — absolutely not cool! 🍽️ This vulnerability allows attackers to read arbitrary form definitions and submission records, which could expose sensitive user information. Imagine the chaos if a competitor gets their hands on your client data or feedback forms — not good at all!
Think of it as a restaurant where anyone can waltz into the back kitchen and peek at the recipes and orders without needing a chef's hat — absolutely not cool! 🍽️ Ninja Forms versions up to 3.13.2 fail to verify user authorization before allowing access to form metadata and submissions via the `ninja-forms-views` REST endpoints. An attacker with a valid bearer token can exploit this to read any form's content by simply loading a page with the Submissions Table block.
This vulnerability allows attackers to read arbitrary form definitions and submission records, which could expose sensitive user information. Imagine the chaos if a competitor gets their hands on your client data or feedback forms — not good at all! Upgrade to Ninja Forms version 3.13.3 immediately, which fixes the initial patch's issues and properly restricts access to the API endpoints. Regularly audit your WordPress plugins to ensure they are updated and secure against such vulnerabilities! You've got this! Follow these steps and keep your forms safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ninjaforms/ninja_forms | < 3.13.1 | 3.13.1 |