Description

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-04T07:17:10.340Z",
  "pubdate": "2026-09-04T07:17:10.340Z",
  "executiveSummary": "The Ninja Forms WordPress plugin versions prior to 3.15.2 are susceptible to an improper authorization vulnerability within its REST API implementation. This security flaw allows users assigned specific, non-default capabilities to perform unauthorized actions as if they possessed full site administrative privileges. The vulnerability stems from an incorrect mapping of a custom plugin capability to full administrative permissions, enabling the manipulation of global plugin settings, the retrieval of sensitive form submission data, and the unauthorized modification or creation of arbitrary site content including posts and pages. While this capability is not assigned to any default WordPress user roles, administrators who have delegated form-building access to lower-privileged users inadvertently expose their systems to significant risk. The impact includes potential full site takeover and unauthorized data exfiltration. Exploitation requires that a target user has been granted the specific, elevated plugin-defined capability, which serves as a vector for privilege escalation beyond the intended scope of form management.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure access control check within the REST API implementation of Ninja Forms versions prior to 3.15.2. The plugin improperly validates permissions by equating a specific, custom plugin-level capability with the 'manage_options' or equivalent administrative capabilities required for critical system actions. This logic failure ensures that any user possessing the specific plugin capability is granted broad, unauthorized access to the REST interface endpoints that govern plugin configuration and site content management.\nThe attack flow proceeds as follows: First, an administrator must have assigned the specific, elevated Ninja Forms capability to a user or role. Second, the attacker—authenticated as the user with this assigned capability—intercepts or crafts requests to the Ninja Forms REST API endpoints. Because the plugin logic incorrectly treats this capability as sufficient for administrative tasks, the REST API gateway permits the execution of sensitive functions. These functions include, but are not limited to, the manipulation of the plugin's internal configuration, reading sensitive stored form submissions, and interacting with core WordPress APIs to create, read, update, or delete site pages and posts.\nThis vulnerability effectively bypasses the Principle of Least Privilege. Even though the capability itself is not granted by default, the architecture of the permission check creates a blind spot where plugin-specific access controls are conflated with site-wide administrative authority. The privilege escalation is realized when the plugin's internal middleware fails to restrict REST request processing to users with true administrative roles, instead relying on the presence of the erroneously scoped capability. The scope of impact is comprehensive; once the REST API accepts the forged request, the attacker can modify site structures, exfiltrate data from submitted forms, or inject malicious content by leveraging the ability to create or edit arbitrary pages and posts. Because the vulnerability is exposed via the WordPress REST API, it is network-accessible to any user who meets the requirement of having the assigned capability, making it a critical risk in environments where delegation of administrative tasks is common.\nAffected versions are strictly those prior to 3.15.2. Remediation requires an immediate update to version 3.15.2 or later, where the REST API capability checks have been refactored to correctly enforce the intended scope of authorization, ensuring that plugin-level capabilities do not grant administrative parity."
}