Ninja Forms, a WordPress form builder plugin, contains a Cross‑Site Request Forgery vulnerability (CWE‑352) that allows unauthenticated attackers to change the plugin’s settings. By exploiting the missing or incorrect nonce validation on the maybe_opt_in() function, a malicious actor can trick a site administrator into submitting a forged request, thereby enabling the site to opt in to usage‑statistics collection. This change does not grant direct access to website data, but it creates a potential channel for third‑party tracking and may expose sensitive operational information about the site to the plugin maintainers.

All installations of Ninja Forms plugin versions 3.12.0 or older for WordPress are affected. The vulnerability applies to any site running the plugin prior to the release that addressed the issue in a later version.

The CVSS score of 4.3 reflects a moderate severity, and the EPSS score of less than 1% suggests the vulnerability is currently unlikely to be widely exploited. The flaw is not listed in CISA’s KEV catalog. In practice, an attacker would need to deceive an administrator into clicking a crafted link or submitting a forged request; no remote code execution or credential compromise is required. Consequently, the risk is largely limited to inadvertent data collection unless combined with additional social engineering.