Vulnerability · Published Sep 4, 2026 · Assigned by WPScan
CVE-2026-80438Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API
Medium 5.9
In plain English
A medium-severity improper access control in Ninja Forms from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Ninja Forms | 3.14.0 – before 3.15.2 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
References
- https://wpscan.com/vulnerability/befced17-95ff-4809-ad13-f63bc60e5670/ exploit, vdb-entry, technical-description