Vulnerabilities / Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder / WPSEC-2026-1743
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.6 - Unauthenticated Missing Authorization to Form Submission
Medium 5.3
CWE-862Fixed in 3.15.7
- ID
- WPSEC-2026-1743
- Plugin
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (ninja-forms)
- Affected
- all versions before 3.15.7
- Remediation
- Update to 3.15.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Ninja Forms plugin for WordPress is vulnerable to unauthorized form submission in all versions up to, and including, 3.15.6 due to the "Require user to be logged in" form setting only being enforced when the form is rendered, not when it is submitted. This makes it possible for unauthenticated attackers to submit forms restricted to logged-in users by posting directly to the submission AJAX endpoint, triggering the form's actions such as emails and stored submissions.
References
- https://wpsec.com/vuln/WPSEC-2026-1743/
- https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.7/
- https://wordpress.org/plugins/ninja-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS