CVE-2026-80438: unknown ninja forms Improper Access Control

Vulnerability summary

CVE-2026-80438 is a medium (CVSS 5.9) Improper Access Control vulnerability in unknown ninja forms. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.4% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.15.2.

Timeline

1. 04-09-2026
   PublishedVulnerability first disclosed.
2. 04-09-2026
   Last modifiedVulnerability information updated.

Description

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.