Ninja Forms WordPress plugin — Missing Authorization allows unauthenticated access to form submission data

CVE-2026-1239 is a missing authorization flaw (CWE-862) in the *Ninja Forms – The Contact Form Builder That Grows With You* plugin for WordPress. A REST or AJAX endpoint that returns form submission data — or an intermediate token that unlocks it — lacks a current_user_can() capability check, so an unauthenticated remote attacker can request submission records they should never see. The impact is purely confidentiality (C:H / I:N / A:N): no code execution, no data tampering, no site takeover. Ninja Forms ships on ~1M+ active WordPress installs, so the raw exposed population is large.

Vendor's HIGH / 7.5 rating tracks the CVSS math cleanly. AV:N/AC:L/PR:N/UI:N is accurate — this is a single unauthenticated HTTP request. The only reason to argue *down* is that the payoff is data theft rather than shell; the reason not to argue *up* is that there is no integrity or availability impact. We land at HIGH but a hair below vendor because there is no public in-the-wild exploitation yet and blast radius is per-site (form data on the compromised site only), not fleet-scale.

Sources.

1. Wordfence Threat Intel — Ninja Forms vulnerabilities
2. WPScan — Ninja Forms plugin advisories
3. Patchstack — Ninja Forms database
4. GitHub Advisory Database — Ninja Forms (GHSA-3xw3-8j95-46mv)
5. CVE Details — Ninja Forms vendor page
6. SentinelOne — CVE-2026-1307 (related Ninja Forms info disclosure)
7. BleepingComputer — Prior mass exploitation history
8. CISA KEV Catalog

Run from an auditor workstation (or CI job) that can reach the target WordPress site over HTTPS. Invoke: ./check_nf_1239.sh https://example.com. No credentials required — this is a *version* check against the plugin's readme.txt. Compare the reported version against the vendor's fixed version listed in the advisory.

#!/usr/bin/env bash
# noisgate — CVE-2026-1239 Ninja Forms version probe
# Usage: ./check_nf_1239.sh <site-url>
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 https://site.example" >&2
  exit 2
fi

# TODO: update FIXED_VERSION once vendor advisory publishes the patched build.
FIXED_VERSION="3.14.2"

README_URL="${TARGET%/}/wp-content/plugins/ninja-forms/readme.txt"
BODY=$(curl -fsSL --max-time 10 -A "noisgate-audit/1.0" "$README_URL" 2>/dev/null || true)

if [[ -z "$BODY" ]]; then
  echo "UNKNOWN: readme.txt not reachable at $README_URL (plugin absent, hardened, or blocked)"
  exit 2
fi

VER=$(printf '%s\n' "$BODY" | grep -iE '^Stable tag:' | head -1 | awk -F: '{print $2}' | tr -d ' \r')

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse Stable tag from readme.txt"
  exit 2
fi

# dotted-version compare via sort -V
LOWEST=$(printf '%s\n%s\n' "$VER" "$FIXED_VERSION" | sort -V | head -1)
if [[ "$LOWEST" == "$FIXED_VERSION" && "$VER" != "$FIXED_VERSION" ]]; then
  echo "PATCHED: Ninja Forms $VER >= $FIXED_VERSION"
  exit 0
elif [[ "$VER" == "$FIXED_VERSION" ]]; then
  echo "PATCHED: Ninja Forms $VER == $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE: Ninja Forms $VER < $FIXED_VERSION (CVE-2026-1239)"
  exit 1
fi