What’s Vulnerable › Vulnerabilities
CVE-2026-80438: Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-04 · updated 2026-09-08
- Weakness: CWE-284
Description
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
Affected products
- kstover Ninja Forms – The Contact Form Builder That Grows With You: from 3.14.0 before 3.15.2 — fixed in 3.15.2
How to fix
Upgrade to a fixed version: kstover Ninja Forms – The Contact Form Builder That Grows With You 3.15.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-80438 or the next vulnerability affects your stack