CVE-2026-15159
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user-controlled key. This allows authenticated attackers with subscriber-level access and above to enumerate any Ninja Forms form ID and download all stored submission data as an XLSX file.
Risk Assessment
The organization is at risk of leaking sensitive personally identifiable information (PII) including names, email addresses, phone numbers, and physical addresses, potentially leading to data protection regulation violations and loss of customer trust.
Recommendation
Immediately update the Ninja Forms - Excel Export plugin to the latest available version that fixes the vulnerability. If an update is not possible, temporarily disable the plugin until a patch is released.
Other vulnerabilities in Ninja Forms - Excel Export
See all- CVE-2026-15161Medium
The Ninja Forms - Excel Export plugin for WordPress up to version 3.3.6 is vulnerable to Stored Cross-Site Scripting. This is due to missing capability checks, nonce verification, and input sanitization in the save_filter() AJAX handler, which stores the raw $_POST['filter'] array into a WordPress option, combined with the get_filter_row() method on the admin Excel Export screen concatenating stored filter values directly into HTML attributes without esc_attr().
- CVE-2026-15160Medium
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This allows authenticated attackers with subscriber-level access and above to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.
Original NVD description (English source)
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate any Ninja Forms form ID and download all stored submission data — including names, email addresses, phone numbers, physical addresses, and any other PII collected by site forms — as a downloadable XLSX file.