CVE-2026-65050: Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the ninja-forms/submissions-table Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via wplocalizescript and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Upgrade Ninja Forms to remove the missing-authorization behavior in the render callback of the `ninja-forms/submissions-table` Gutenberg block so stored form submission field values (PII) are not disclosed to unauthenticated visitors via an embedded block with an arbitrary formID.
WordPress Ninja Forms Gutenberg block (ninja-forms/submissions-table) Authorization enforcement for render callback / access control for arbitrary formID = Require authenticated/authorized access (do not allow unauthenticated visitors to render submissions for arbitrary formID)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65050?
The severity of CVE-2026-65050 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-65050?
To fix CVE-2026-65050, update the Ninja Forms WordPress plugin to version 3.14.9 or later.
What type of vulnerability is CVE-2026-65050?
CVE-2026-65050 is a missing authorization vulnerability affecting the Ninja Forms Gutenberg block.
Who is affected by CVE-2026-65050?
Authenticated users with Author-level privileges are affected by CVE-2026-65050.
What are the potential impacts of CVE-2026-65050?
CVE-2026-65050 can allow authenticated attackers to expose sensitive form submissions to unauthenticated visitors.