Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
Strategic Overview
- Status
- Patched in 3.13.3
- Affected Plugin
- Ninja Forms – The Contact Form Builder That Grows With You
- Affected Version
<= 3.13.2- CVSS
- 7.5High
- Weakness type
- CWE-639 · Authorization Bypass Through User-Controlled Key
- CVE
CVE-2025-11924
At a glance
CVE-2025-11924 is a high-severity Authorization Bypass Through User-Controlled Key vulnerability in the Ninja Forms WordPress plugin, affecting versions <= 3.13.2. It carries a CVSS score of 7.5 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires no authentication. The issue is fixed in version 3.13.3; sites on affected versions should update now. Disclosed December 2025, reported by Lucas Montes (NiRoX).
Vulnerability Overview
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.
CWE-639: Authorization Bypass Through User-Controlled Key
Reaching this weakness in Ninja Forms <= 3.13.2 takes no account at all. Authorization bypass through a user-controlled key, often called insecure direct object reference, means the application looks up a record by an identifier from the request without checking that the caller owns it.
Changing a number in the request is enough to read or modify other users' records, which on commerce and membership sites means customer data. For Ninja Forms the fix is 3.13.3: builds <= 3.13.2 are affected, anything from 3.13.3 onward is not.
Remediation
Update to version 3.13.3, or a newer patched version
How does WordSec protect against this?
This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Ninja Forms 3.13.3 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Related records
Other vulnerabilities in Ninja Forms – The Contact Form Builder That Grows With You
- 9.8Ninja Forms Contact Form Code Injection
- 9.8CVE-2019-15025: Ninja Forms Contact Form <= 3.3.21.1 SQL Injection
CVE-2019-15025 - 9.8CVE-2016-1209: Ninja Forms Contact Form… Arbitrary File Upload
CVE-2016-1209 - 9.1CVE-2018-20981: Ninja Forms Insufficient Restrictions during Export
CVE-2018-20981 - 8.8Ninja Forms Contact Form CSRF to Field Import and PHP Object Injection
- 8.8CVE-2021-24163: Ninja Forms Contact Form SendWP Plugin Installation
CVE-2021-24163 - 8.8CVE-2020-36174: Ninja Forms Contact Form CSRF to Plugin Installation
CVE-2020-36174 - 8.8Ninja Forms Contact Form <= 2.9.55.1 SQL Injection
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C