High · published February 10, 2026
⚡ An unauthenticated attacker can access sensitive post metadata, thanks to a sneaky oversight in Ninja Forms! 🤯 Think of it like a diner’s receipt accidentally spilling out personal information to anyone passing by, because the server forgot to check who was at the table before handing it over. In this case, the merge tags are the receipts, revealing confidential info like WooCommerce billing emails and API keys without a security check! This vulnerability could lead to major privacy breaches, exposing customer personal information, billing details, and API tokens. An attacker could exploit this flaw and gain unauthorized access to sensitive data, potentially leading to significant reputational damage or financial loss for your business.
Think of it like a diner’s receipt accidentally spilling out personal information to anyone passing by, because the server forgot to check who was at the table before handing it over. In this case, the merge tags are the receipts, revealing confidential info like WooCommerce billing emails and API keys without a security check! The Ninja Forms plugin is vulnerable due to the unsafe application of the `ninja_forms_merge_tags` filter on user input in repeater fields, allowing unauthenticated users to retrieve arbitrary post metadata through the `nf_ajax_submit` AJAX action without proper authorization checks.
This vulnerability could lead to major privacy breaches, exposing customer personal information, billing details, and API tokens. An attacker could exploit this flaw and gain unauthorized access to sensitive data, potentially leading to significant reputational damage or financial loss for your business. To protect your site, immediately update the Ninja Forms plugin to version 3.14.1 or later. Review your website’s post metadata access controls and educate your team on the importance of secure data handling practices. You’ve got this! By following these steps, you’ll keep your site secure and your customers’ data safe. 🛡️