CVE-2026-1239CWE-862

Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

High · published July 1, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00484 · 40.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-01T05:35Z
EPSS history
Timeline
  • 01 JUL 05:35Z
    Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
    cvelistv5