CVE-2025-14072

Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

Affected

Ninja Forms

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2026-01-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4b19a333-eb19-4903-aa96-1fe871dd0f9f/

Security advisories

• https://wpscan.com/vulnerability/4b19a333-eb19-4903-aa96-1fe871dd0f9f

References

• CVE Record
• NVD entry