Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.6 - Unauthenticated Sensitive Information Exposure via Merge Tags in Submitted Values
- ID
- WPSEC-2026-1741
- Plugin
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (ninja-forms)
- Affected
- all versions before 3.15.7
- Remediation
- Update to 3.15.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via merge tags in all versions up to, and including, 3.15.6, due to values substituted by one merge tag group, such as submitted field values and querystring values, keeping their merge tag braces, so merge tags inside them are expanded by groups that run later. This makes it possible for unauthenticated attackers to put merge tags such as {system:admin_email} or {post:author_email} in a submitted value and read the site and post details they resolve to in success messages and form emails that include the submitted value.
References
- https://wpsec.com/vuln/WPSEC-2026-1741/
- https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.7/
- https://wordpress.org/plugins/ninja-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS