Ninja Forms WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Ninja Forms WordPress plugin, specifically in versions through 3.14.1. The issue arises from a callback function in blocks/bootstrap.php that handles the admin_enqueue_scripts action. This vulnerability enables authenticated attackers with Contributor-level access or higher to access an authorization token, which can be used to view form submissions from any form. These submissions may contain sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information contained in form submissions, potentially including personal data or other confidential details.

Remediation

Users are advised to update the Ninja Forms WordPress plugin to version 3.14.2 or a newer patched version.