Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API

Description

The plugin does not restrict its REST abilities to administrators, accepting a plugin-specific capability as equivalent to full site administration, which allows any user granted that capability to read plugin settings and stored form submissions, overwrite the plugin's configuration, and create or modify arbitrary posts and pages.
The capability belongs to no default WordPress role and the plugin never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.