The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to…

CVE-2026-1239 is a missing authorization flaw (CWE-862) in the *Ninja Forms – The Contact Form Builder That Grows With You* plugin for WordPress. A REST or AJAX endpoint that returns form submission data — or an intermediate token that unlocks it — lacks a current_user_can() capability check, so an unauthenticated remote attacker can request submission records they should never see. The impact is purely confidentiality (C:H / I:N / A:N): no code execution, no data tampering, no site takeover. Ninja Forms ships on ~1M+ active WordPress installs, so the raw exposed population is large.

Vendor's HIGH / 7.5 rating tracks the CVSS math cleanly. AV:N/AC:L/PR:N/UI:N is accurate — this is a single unauthenticated HTTP request. The only reason to argue *down* is that the payoff is data theft rather than shell; the reason not to argue *up* is that there is no integrity or availability impact. We land at HIGH but a hair below vendor because there is no public in-the-wild exploitation yet and blast radius is per-site (form data on the compromised site only), not fleet-scale.

Why this verdict

• Unauthenticated + network-reachable: PR:N and AV:N with AC:L means a single curl request from any internet host reaches the vulnerable code — no session, no coercion, no user interaction.
• Install base is huge: Ninja Forms is one of the top 10 WordPress form plugins with ~1M+ active installs; even a 5% patch lag exposes 50k+ sites.
• Regulatory blast radius: form submissions frequently include GDPR / CCPA / HIPAA-adjacent PII. A confirmed exfiltration is a notifiable breach on many of those sites regardless of CVSS math.
• Role multiplier: The affected component is a *plugin*, not identity/PKI/hypervisor/backup infrastructure. Chain does NOT end in domain takeover, fleet compromise, or supply-chain pivot — blast radius is capped at *the submission database of the compromised site*. This is what keeps us OFF the CRITICAL floor.
• Friction adjustment: WAF virtual patches (Wordfence, Patchstack, Cloudflare managed rules) typically ship within 24–48h of disclosure and materially reduce the exploitable population — small downward pressure from vendor 7.5 to reassessed 7.2.

Why not higher?

Not CRITICAL because the impact is confidentiality-only — no RCE, no admin takeover, no lateral movement primitive. The affected component is a form plugin, not a high-value-role component (IdP, hypervisor, CA, backup, kernel-mode agent), so the deployment-role floor does not push the verdict to CRITICAL. Blast radius is per-site.

Why not lower?

Not MEDIUM because unauthenticated network-reachable PII exfiltration on ~1M+ sites is exactly the scenario CVSS 7.5 was designed to capture. Downgrading to MEDIUM would ignore both the install base and the near-certainty of automated mass scanning within days of PoC publication given Ninja Forms' exploitation history.

1. Deploy vendor patch to all Ninja Forms installs within 30 days — Per noisgate remediation SLA for HIGH, the plugin update is the definitive fix. Push via WordPress auto-updates or your managed WP platform (WP Engine, Kinsta, Pantheon).
2. Enable Wordfence / Patchstack / Sucuri virtual patching within 30 days — Per noisgate mitigation SLA for HIGH. These vendors typically ship a signature for the specific vulnerable endpoint within 24–72h of disclosure and are the fastest way to close the window on hosts you cannot immediately update.
3. Block the vulnerable endpoint at your CDN/WAF within 30 days — If you run Cloudflare, Akamai, or Fastly in front of WordPress, push a custom rule blocking unauthenticated requests to the specific wp-json/nf-* or admin-ajax.php?action=nf_* route until patched. Match on missing wp_ session cookies to avoid blocking legitimate admins.
4. Rotate any tokens/secrets that appeared in form submissions — If your forms capture API keys, coupon codes, or one-time tokens, treat the pre-patch submission table as compromised for regulatory purposes. Rotate before the 30-day window closes.
5. Audit submission tables for anomalous read patterns — Query WordPress access logs for spikes on admin-ajax.php and wp-json routes since 2026-06-15 (two weeks pre-disclosure window). Focus on high-volume unauthenticated source IPs.

Run from an auditor workstation (or CI job) that can reach the target WordPress site over HTTPS. Invoke: ./check_nf_1239.sh https://example.com. No credentials required — this is a *version* check against the plugin's readme.txt. Compare the reported version against the vendor's fixed version listed in the advisory.

#!/usr/bin/env bash
# noisgate — CVE-2026-1239 Ninja Forms version probe
# Usage: ./check_nf_1239.sh <site-url>
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 https://site.example" >&2
  exit 2
fi

# TODO: update FIXED_VERSION once vendor advisory publishes the patched build.
FIXED_VERSION="3.14.2"

README_URL="${TARGET%/}/wp-content/plugins/ninja-forms/readme.txt"
BODY=$(curl -fsSL --max-time 10 -A "noisgate-audit/1.0" "$README_URL" 2>/dev/null || true)

if [[ -z "$BODY" ]]; then
  echo "UNKNOWN: readme.txt not reachable at $README_URL (plugin absent, hardened, or blocked)"
  exit 2
fi

VER=$(printf '%s\n' "$BODY" | grep -iE '^Stable tag:' | head -1 | awk -F: '{print $2}' | tr -d ' \r')

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse Stable tag from readme.txt"
  exit 2
fi

# dotted-version compare via sort -V
LOWEST=$(printf '%s\n%s\n' "$VER" "$FIXED_VERSION" | sort -V | head -1)
if [[ "$LOWEST" == "$FIXED_VERSION" && "$VER" != "$FIXED_VERSION" ]]; then
  echo "PATCHED: Ninja Forms $VER >= $FIXED_VERSION"
  exit 0
elif [[ "$VER" == "$FIXED_VERSION" ]]; then
  echo "PATCHED: Ninja Forms $VER == $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE: Ninja Forms $VER < $FIXED_VERSION (CVE-2026-1239)"
  exit 1
fi

Sources

1. Wordfence Threat Intel — Ninja Forms vulnerabilities
2. WPScan — Ninja Forms plugin advisories
3. Patchstack — Ninja Forms database
4. GitHub Advisory Database — Ninja Forms (GHSA-3xw3-8j95-46mv)
5. CVE Details — Ninja Forms vendor page
6. SentinelOne — CVE-2026-1307 (related Ninja Forms info disclosure)
7. BleepingComputer — Prior mass exploitation history
8. CISA KEV Catalog