# Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.6 - Unauthenticated Sensitive Information Exposure via Referer-Derived Post Merge Tags

- **ID:** WPSEC-2026-1742
- **Plugin:** Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (`ninja-forms`), https://wordpress.org/plugins/ninja-forms/
- **Affected versions:** all versions before 3.15.7
- **Fixed in:** 3.15.7 (Update to 3.15.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ninja-forms
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1742/

## Description

The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via post merge tags in all versions up to, and including, 3.15.6, due to the post used by post merge tags during AJAX form submissions being taken from the client-controlled Referer without checking that the submitter can view that post. This makes it possible for unauthenticated attackers to read the title, author details and meta of private or draft posts through success messages and form emails that use post merge tags.

## References

- https://wpsec.com/vuln/WPSEC-2026-1742/
- https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.7/
- https://wordpress.org/plugins/ninja-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1742/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.