{
 "id": "WPSEC-2026-1743",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1743/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1743/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1743/index.md",
 "title": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.6 - Unauthenticated Missing Authorization to Form Submission",
 "description": "The Ninja Forms plugin for WordPress is vulnerable to unauthorized form submission in all versions up to, and including, 3.15.6 due to the \"Require user to be logged in\" form setting only being enforced when the form is rendered, not when it is submitted. This makes it possible for unauthenticated attackers to submit forms restricted to logged-in users by posting directly to the submission AJAX endpoint, triggering the form's actions such as emails and stored submissions.",
 "plugin": {
  "slug": "ninja-forms",
  "name": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder",
  "full_name": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/ninja-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ninja-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ninja-forms"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.15.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.15.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.15.7",
 "remediation": "Update to 3.15.7 or later.",
 "fix_released": "2026-10-26T13:04:17+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:39:26.625277+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1743/",
  "https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.7/",
  "https://wordpress.org/plugins/ninja-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ninja-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}