CVE-2026-1239

HIGH

Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-1239. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-1239, an unauthorized data access vulnerability in the Ninja Forms WordPress plugin due to a missing authorization check. The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation.

Description

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-1239_the_ninja_forms.py

This repository contains an auto-generated stub module for CVE-2026-1239, an unauthorized data access vulnerability in the Ninja Forms WordPress plugin due to a missing authorization check. The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation.

Classification
Stub 98%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Theoretical
Target: Ninja Forms WordPress plugin (unspecified version)
No auth needed
Prerequisites: Target must be running a vulnerable version of Ninja Forms plugin · Network access to the WordPress site (HTTP/HTTPS)
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0030
EPSS Percentile 22.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
kstover/Ninja Forms – The Contact Form Builder That Grows With You < 3.14.1
Published Jul 01, 2026
Tracked Since Jul 01, 2026