What’s Vulnerable › Vulnerabilities
CVE-2025-14072: Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-01-02 · updated 2026-06-17
Description
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.
Affected products
- kstover Ninja Forms – The Contact Form Builder That Grows With You: before 3.13.3 — fixed in 3.13.3
How to fix
Upgrade to a fixed version: kstover Ninja Forms – The Contact Form Builder That Grows With You 3.13.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-14072 or the next vulnerability affects your stack