WordPress Plugin Vulnerabilities

Ninja Forms < 3.14.2 - Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

Description

The plugin is vulnerable to unauthorized access of data due to a missing authorization check on the `ninja-forms-views/token/refresh` REST API callback. This makes it possible for unauthenticated attackers to obtain a valid token and view form submissions, which could potentially contain sensitive information.

Affects Plugins

Plugin icon
ninja-forms
Fixed in 3.14.2

References

CVE
CVE-2026-1239
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/973ebafc-85c0-4cc5-b307-2fdb0a4a7577

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
suyoung kim(AhnLab)
Verified
No
WPVDB ID
c73c071d-51d6-4b6f-bc8a-530e39e2714c

Timeline

Publicly Published
2026-06-30 (about 1 month ago)
Added
2026-06-30 (about 1 month ago)
Last Updated
2026-06-30 (about 1 month ago)

Other

Published
Title
Published
2026-02-02
Title
Tutor LMS < 3.9.6 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
Published
2024-11-08
Title
Magical Addons For Elementor < 1.2.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template
Published
2026-01-25
Title
Hustle < 7.8.9.3 - Unauthenticated Information Exposure
Published
2021-03-03
Title
User Profile Picture < 2.5.0 - Sensitive Information Disclosure
Published
2023-11-21
Title
UserPro < 5.1.2 - Sensitive Information Disclosure via Shortcode