# Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.6 - Unauthenticated Missing Authorization to Form Submission

- **ID:** WPSEC-2026-1743
- **Plugin:** Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (`ninja-forms`), https://wordpress.org/plugins/ninja-forms/
- **Affected versions:** all versions before 3.15.7
- **Fixed in:** 3.15.7 (Update to 3.15.7 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ninja-forms
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1743/

## Description

The Ninja Forms plugin for WordPress is vulnerable to unauthorized form submission in all versions up to, and including, 3.15.6 due to the "Require user to be logged in" form setting only being enforced when the form is rendered, not when it is submitted. This makes it possible for unauthenticated attackers to submit forms restricted to logged-in users by posting directly to the submission AJAX endpoint, triggering the form's actions such as emails and stored submissions.

## References

- https://wpsec.com/vuln/WPSEC-2026-1743/
- https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.7/
- https://wordpress.org/plugins/ninja-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1743/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.