5.9
Moyenne
CVE-2026-80438 The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a…
Description
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ninja Forms 3.14 | 3.14.0 → < 3.15.2 | 3.15.2 |
Autres CVE de Ninja Forms
Les 11 CVE de Ninja Forms →
CVE-2026-91827
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when…
7.5
Élevée
CVE-2026-92438
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the…
8.8
Élevée
CVE-2026-80437
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from…
4.8
Moyenne
CVE-2026-15256
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to…
4.8
Moyenne