CVE-2026-80438
Received Received - Intake

Privilege Escalation in Ninja Forms WordPress Plugin

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: WPScan

Description
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80438
EUVD
EUVD-2026-70907

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ninja_forms ninja_forms From 3.14.0 (inc) to 3.15.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Ninja Forms WordPress plugin versions 3.14.0 to 3.15.1. It involves improper access control in the plugin's REST API, where a custom capability is treated as equivalent to full site administration. This allows authenticated users with that capability to read settings and form submissions, modify plugin configuration, and create or edit posts and pages.

Detection Guidance

Check the installed version of Ninja Forms using the WordPress admin panel or run the command 'wp plugin list' in the WordPress directory. If the version is between 3.14.0 and 3.15.1, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to access sensitive form data, alter plugin settings, or modify website content. Attackers could read stored submissions, change form configurations, or create/edit posts and pages without proper authorization.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data stored in form submissions, potentially violating GDPR or HIPAA requirements for data protection and access control. Organizations may face compliance violations if sensitive data is exposed or altered.

Mitigation Strategies

Update Ninja Forms to version 3.15.2 or later immediately. Review user roles and capabilities to ensure no unauthorized users have the plugin-specific capability that grants elevated access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80438. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart