CVE-2026-80438: Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ninja Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.15.2 - Compensating control
Ensure the ability/capability mentioned in the vulnerability description (the one accepted by Ninja Forms abilities REST API as equivalent to full site administration) is not granted to non-administrator users; remove/delegate assignment of that capability from users unless they are administrators.
Event History
Frequently Asked Questions
Are default WordPress roles affected?
No. The required Ninja Forms-specific capability is not assigned to any default WordPress role, and the plugin does not grant it automatically. Exposure exists only where an administrator has manually assigned the capability, commonly while delegating form-builder access.
What access does an attacker need to exploit this issue?
An attacker must be an authenticated WordPress user who has been granted the affected Ninja Forms-specific capability. That capability is treated as equivalent to full site administration by the vulnerable REST abilities.
What could an affected user do?
They can read Ninja Forms settings and stored form submissions, overwrite Ninja Forms configuration, and create or modify arbitrary WordPress posts and pages.
How can I determine whether my site is exposed?
Review users and roles for assignments of the Ninja Forms-specific capability, particularly accounts given access to the form builder. Sites where no user has been assigned that capability are not exposed through this issue.
What should be done if upgrading is not immediately possible?
Remove the affected Ninja Forms-specific capability from non-administrator users and roles, especially delegated form-builder accounts. This prevents those accounts from accessing the vulnerable REST abilities.