CVE-2021-34647

The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.

• CWE-863
• CWE-862

• https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Routes/Submissions.php?rev=2543837#L107Patch, Third Party Advisory
• https://www.wordfence.com/blog/2021/09/recently-patched-vulnerabilities-in-ninja-forms-plugin-affects-over-1-million-site-owners/Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Routes/Submissions.php?rev=2543837#L107Patch, Third Party Advisory
• https://www.wordfence.com/blog/2021/09/recently-patched-vulnerabilities-in-ninja-forms-plugin-affects-over-1-million-site-owners/Exploit, Third Party Advisory

Published

Sep 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-34641The SEOPress WordPress plugin is vulnerable to Stored Cross-…5.4
• CVE-2021-34642The Smart Email Alerts WordPress plugin is vulnerable to Ref…6.1
• CVE-2021-34643The Skaut bazar WordPress plugin is vulnerable to Reflected …6.1
• CVE-2021-34644The Multiplayer Games WordPress plugin is vulnerable to Refl…6.1
• CVE-2021-34645The Shopping Cart & eCommerce Store WordPress plugin is vuln…8.8
• CVE-2021-34646Versions up to, and including, 5.4.3, of the Booster for Woo…9.8
• CVE-2021-34648The Ninja Forms WordPress plugin is vulnerable to arbitrary …4.3
• CVE-2021-34649The Simple Behance Portfolio WordPress plugin is vulnerable …6.1
• CVE-2021-3465Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-34650The eID Easy WordPress plugin is vulnerable to Reflected Cro…6.1
• CVE-2021-34651The Scribble Maps WordPress plugin is vulnerable to Reflecte…6.1
• CVE-2021-34652The Media Usage WordPress plugin is vulnerable to Reflected …6.1