The vulnerability in Ninja Forms up to version 3.12.0 allows an attacker to delete CSV files exported through the plugin without authentication. The flaw arises from missing or incorrect nonce validation when exporting CSVs, enabling a CSRF attack that results in file deletion. This weakness, denoted by CWE 352, does not expose data to unauthorized reading but compromises data integrity by removing potentially important submission exports.

The problem affects the Ninja Forms – The Contact Form Builder That Grows With You WordPress plugin. Any site running a version of the plugin 3.12.0 or earlier is potentially compromised. The vulnerability is specific to the export feature that outputs CSV files, and it relies on administrative privileges to trigger the deletion.

With a CVSS score of 4.3 the flaw is considered moderate and its EPSS score is below 1%, indicating low expected frequency of exploitation. The flaw is not listed in CISA's KEV catalog. An attacker would need to lure an administrator into clicking a crafted link that forces the export action; because the nonce is not verified, the request succeeds and deletes the targeted file. There are no known public exploit code releases, but the nature of CSRF means that the attack could be carried out with minimal technical skill once the admin is tricked.