CVE-2025-11924

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.

• CWE-639

• https://plugins.trac.wordpress.org/changeset/3415563/ninja-formsPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4240cdae-9122-443e-8a7e-3369e74384be?source=cveThird Party Advisory

Published

Dec 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11919The default JVM can access files and directories under `/tmp…9.6
• CVE-2025-1192A vulnerability was found in SourceCodester Multi Restaurant…8.8
• CVE-2025-11920The WPCOM Member plugin for WordPress is vulnerable to Local…8.8
• CVE-2025-11921iStats contains an insecure XPC service that allows local, u…8.5
• CVE-2025-11922The Inactive Logout plugin for WordPress is vulnerable to St…6.4
• CVE-2025-11923The LifterLMS – WP LMS for eLearning, Online Courses, & Quiz…8.8
• CVE-2025-11925Incorrect Content-Type header in one of the APIs (`text/html…6.1
• CVE-2025-11926The Related Posts Lite plugin for WordPress is vulnerable to…4.4
• CVE-2025-11927The Flying Images: Optimize and Lazy Load Images for Faster …4.4
• CVE-2025-11928The CSS & JavaScript Toolbox plugin for WordPress is vulnera…4.4
• CVE-2025-1193Improper host validation in the certificate validation compo…8.1
• CVE-2025-11931Integer Underflow Leads to Out-of-Bounds Access in XChaCha20…8.2