CVE-2025-11924
Insecure Direct Object Reference in Ninja Forms Plugin Allows Data Exposure
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | ninja_forms | 3.13.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Insecure Direct Object Reference (IDOR) in the Ninja Forms WordPress plugin up to version 3.13.2. It occurs because the plugin does not properly verify user authorization before allowing access to the 'ninja-forms-views' REST endpoints, which return form metadata and submission content. As a result, unauthenticated attackers can read arbitrary form definitions and submission records if they have a leaked bearer token and can load any page containing the Submissions Table block. A patch was released in version 3.13.1, but it was ineffective because it introduced a REST API endpoint that allowed minting valid bearer tokens for arbitrary form IDs.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive form data and submission records. Attackers can access private information submitted through forms without authentication, potentially exposing personal or confidential data. This can result in privacy breaches and loss of trust in the affected website.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Ninja Forms plugin to a version later than 3.13.2 where the issue is patched. Avoid using versions up to and including 3.13.2, as they contain insecure direct object reference flaws allowing unauthorized access to form data. Additionally, review and restrict access to REST API endpoints related to ninja-forms-views and bearer token issuance until a secure patch is confirmed.