CVE-2026-65050

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin versions prior to 3.14.9

Description A missing authorization issue exists in the render callback of the ninja-forms/submissions-table Gutenberg block. Authenticated attackers with Author-level privileges can embed this block with an arbitrary formID in a published post to expose stored form submissions to unauthenticated visitors. By retrieving the signed bearer token injected into the visitor's browser via wp localize script, attackers can target the REST API submissions endpoint to access sensitive personally identifiable information, including names, email addresses, and phone numbers.

Recommendations Update Ninja Forms WordPress plugin to version 3.14.9 or later.