CVEvulnerability

CVE-2025-14072

5.3 MEDIUM Published 2026-01-02 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

Affected configurations

• ninjaforms ninja forms (< 3.13.3)

References