The vulnerability in Ninja Forms up to version 3.14.1 allows authenticated users with Contributor-level access or higher to obtain an authorization token that grants visibility into form submissions. This token can be used to view any form submission data, potentially exposing personally identifiable information, credentials, or other sensitive content that should remain confidential.

The affected product is the WordPress plugin Ninja Forms – The Contact Form Builder That Grows With You, specifically all releases through and including version 3.14.1. No other vendors or products are listed as affected.

The CVSS score is 6.5, indicating moderate severity, and the vulnerability is not listed in the CISA KEV catalog. While no EPSS score is provided, the attack requires a valid Contributor or higher role, a common privilege level in many installations. An attacker could exploit the exposed token to download or view all form submissions, leading to confidentiality compromise. The limited need for elevated privileges reduces the barrier to exploitation but still poses a meaningful risk to sites handling sensitive data.