CVE-2026-1239: fallo de gravedad alta en kstover Ninja Forms – The Contact Form Builder…
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.5%
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
kstover · Ninja Forms – The Contact Form Builder That Grows With YouCVEs relacionadas — kstover Ninja Forms – The Contact Form Builder…
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-11363MEDIUMNinja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form ImportEPSS 0.9%CVE-2024-0685MEDIUMNinja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL InjectionEPSS 0.8%CVE-2026-15663MEDIUMNinja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' KeyEPSS 0.5%CVE-2024-12238MEDIUMNinja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2025-11924HIGHNinja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer TokenEPSS 0.4%CVE-2026-19769HIGHNinja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array KeyEPSS 0.4%