CVE-2025-14072

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 28th percentile

Published

2026-01-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4b19a333-eb19-4903-aa96-1fe871dd0f9f/

References

• CVE Record
• NVD entry

Related

• CVE-2025-14052
• CVE-2025-14085
• CVE-2025-14051
• CVE-2025-14086
• CVE-2025-14047
• CVE-2025-14088