The vulnerability is an Insecure Direct Object Reference that allows an unauthenticated attacker to retrieve complete form metadata and any submitted data by using a bearer token that was leaked when a page containing the Submissions Table block was loaded. Because the plugin fails to validate that a user is authorized to access this data, an attacker can obtain arbitrary form definitions and submission records, potentially exposing sensitive personal information and credentials. The weakness is cataloged as CWE‑639 and can lead to significant confidentiality breaches if sensitive submission content is captured.

The affected product is the Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress. All releases through version 3.13.2 are vulnerable. Although an earlier patch was released in 3.13.1, it introduced a new flaw that still allows bearer‑token generation for arbitrary forms, so only versions later than 3.13.2 (currently 3.13.3 and newer) are considered safe.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog, which supports the low likelihood assessment. However, if an attacker can obtain a bearer token, the IDOR can be exploited via the publicly exposed REST endpoints, giving them read‑only access to all submission data. The impact is therefore primarily confidentiality exposure and possible compromise of personal data.