CVE-2025-14072: Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure
Published Jan 2, 2026
·Updated
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.
Affected Software
2 affected components
wordpress/NinjaForms<3.13.3
NinjaForms Ninja Forms Wordpress<3.13.3
Event History
Jan 2, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-14072?
CVE-2025-14072 is classified as a high-severity vulnerability due to its ability to allow unauthenticated attackers to access sensitive data.
2
How do I fix CVE-2025-14072?
To fix CVE-2025-14072, update the Ninja Forms plugin to version 3.13.3 or later.
3
What specific issue does CVE-2025-14072 present in the Ninja Forms plugin?
CVE-2025-14072 allows unauthorized users to generate valid access tokens through the REST API, compromising form submission security.
4
Is my site vulnerable if I am using a version of Ninja Forms older than 3.13.3?
Yes, if you are using a version of Ninja Forms older than 3.13.3, your site is vulnerable to CVE-2025-14072.
5
What types of data could be accessed through CVE-2025-14072?
Through CVE-2025-14072, attackers could potentially access sensitive user data contained in form submissions.