CVE-2026-65050: saturday drive ninja forms Missing Authorization

Vulnerability summary

CVE-2026-65050 is a high (CVSS 7.1) Missing Authorization vulnerability in saturday drive ninja forms. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.6% of scored vulnerabilities.

Timeline

1. 21-07-2026
   PublishedVulnerability first disclosed.
2. 23-07-2026
   Last modifiedVulnerability information updated.

Description

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.