CVE-2025-14072
Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jan 2, 2026
- Updated
- Jan 2, 2026
- Reserved
- Dec 4, 2025
Description
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Ninja FormsUnknown |
|
References
- https://wpscan.com/vulnerability/4b19a333-eb19-4903-aa96-1fe871dd0f9f/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.