Vulnerabilities / Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder / WPSEC-2026-1742
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.6 - Unauthenticated Sensitive Information Exposure via Referer-Derived Post Merge Tags
Medium 5.3
CWE-639Fixed in 3.15.7
- ID
- WPSEC-2026-1742
- Plugin
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (ninja-forms)
- Affected
- all versions before 3.15.7
- Remediation
- Update to 3.15.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via post merge tags in all versions up to, and including, 3.15.6, due to the post used by post merge tags during AJAX form submissions being taken from the client-controlled Referer without checking that the submitter can view that post. This makes it possible for unauthenticated attackers to read the title, author details and meta of private or draft posts through success messages and form emails that use post merge tags.
References
- https://wpsec.com/vuln/WPSEC-2026-1742/
- https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.7/
- https://wordpress.org/plugins/ninja-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS