Ninja Forms versions 3.14.8 and earlier include a missing authorization flaw in the render callback of the Ninja Forms Submissions-Table Gutenberg block. An attacker who is already authenticated at the Author level can insert this block into a published post and specify any form ID. The block renders the submissions interface and injects a signed bearer token into the page for every visitor. An unauthenticated visitor who views the page receives this token and can then call the REST API submissions endpoint to retrieve all stored field values, including sensitive personally identifiable information such as names, email addresses, phone numbers, and other user-supplied data. The result is a clear data-exposure risk for any site that uses Ninja Forms without restricting block usage or updating the plugin.

The affected product is the Ninja Forms WordPress plugin, produced by Saturday Drive. All installations running version 3.14.8 or older are vulnerable. The vulnerability is present in the submissions-table Gutenberg block rendered on any published WordPress page or post.

The CVSS score of 7.1 indicates a medium severity. The EPSS score is reported as less than 1%, suggesting a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in CISA's KEV catalog. However, the attack requires only author-level access and the ability to embed a block in a public page, which are common conditions on many sites. Once the exploit is possible, the attacker can expose all saved form submissions to any unauthenticated visitor, resulting in broad privacy violations.