CVE-2025-11924

36th percentile - higher than 36% of all known CVEs

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.

An unauthenticated attacker can read sensitive form and submission data, including personal information submitted by users. This data leak may lead to privacy breaches and regulatory compliance issues.

Update the plugin to a version later than 3.13.2 that fixes both the original vulnerability and the flawed patch. Until updated, consider restricting access to the REST endpoints or disabling the Submissions Table block.