CVE-2026-65050
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
No public exploitation has been reported so far. No distribution fix is listed yet; apply vendor mitigations and monitor.
Recommended action: Track your distribution's security tracker and apply the fix as soon as it ships.
Severity metrics
CVSS 4.0 : 7.1 HIGH · CVSS 3.1 : 6.5 MEDIUM
Vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected & fixed versions by distribution
Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.
No affected package in the tracked watchlist yet (Debian, Ubuntu, Arch, SUSE, Red Hat...). Triage may still be pending.