{
 "id": "WPSEC-2026-1741",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1741/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1741/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1741/index.md",
 "title": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.6 - Unauthenticated Sensitive Information Exposure via Merge Tags in Submitted Values",
 "description": "The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via merge tags in all versions up to, and including, 3.15.6, due to values substituted by one merge tag group, such as submitted field values and querystring values, keeping their merge tag braces, so merge tags inside them are expanded by groups that run later. This makes it possible for unauthenticated attackers to put merge tags such as {system:admin_email} or {post:author_email} in a submitted value and read the site and post details they resolve to in success messages and form emails that include the submitted value.",
 "plugin": {
  "slug": "ninja-forms",
  "name": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder",
  "full_name": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/ninja-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ninja-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ninja-forms"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.15.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.15.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.15.7",
 "remediation": "Update to 3.15.7 or later.",
 "fix_released": "2026-10-26T13:04:17+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:39:26.625277+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1741/",
  "https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.7/",
  "https://wordpress.org/plugins/ninja-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ninja-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}