CVE-2025-14072

PoC —

CVSS 3.1

5.3 medium

EPSS

<1%p28

Published

Jan 2, 2026 (Jan 2, 2026)

Modified

Jun 17, 2026

Description

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

Vendors: ninjaforms
Products: ninja forms
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.