CVE-2025-14072

Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure

CVSS 5.3 MEDIUMEPSS 0.3%

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

02 ene 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Productos afectados

Unknown · Ninja Forms

Referencias

https://wpscan.com/vulnerability/4b19a333-eb19-4903-aa96-1fe871dd0f9f/