The Ninja Forms plugin for WordPress contains a flaw in the nf_ajax_submit AJAX action where the ninja_forms_merge_tags filter is applied to user-supplied input in repeater fields without proper authorization checks. This allows an unauthenticated user to resolve {post_meta:KEY} merge tags, revealing arbitrary post metadata. Consequently an attacker can access sensitive data such as WooCommerce billing emails, API keys, private tokens, and customer personal information, leading to a violation of confidentiality.

Versions of Ninja Forms 3.14.0 and earlier are affected. The vulnerability exists across all WordPress sites that have any version of Ninja Forms up to and including 3.14.0 installed.

The CVSS base score of 7.5 indicates a high impact with an unauthenticated external attack vector. The EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, an attacker who discovers the public nf_ajax_submit endpoint could exploit the lack of authorization checks to harvest sensitive metadata from the site without needing to authenticate.