CVE-2026-2268

The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the `ninja_forms_merge_tags` filter to user-supplied input within repeater fields, which allows the resolution of `{post_meta:KEY}` merge tags without authorization checks. This makes it possible for unauthenticated attackers to extract arbitrary post metadata from any post on the site, including sensitive data such as WooCommerce billing emails, API keys, private tokens, and customer personal information via the `nf_ajax_submit` AJAX action.

• CWE-200

• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.13.3/includes/AJAX/Controllers/Submission.php#L222
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.13.3/includes/AJAX/Controllers/Submission.php#L706
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.13.3/includes/MergeTags/WP.php#L48
• https://plugins.trac.wordpress.org/changeset/3454719/ninja-forms/trunk/includes/AJAX/Controllers/Submission.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/24902fab-44ea-44c9-bcf5-70960cfeb402?source=cve

Published

Feb 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22674Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, c…4.8
• CVE-2026-22675OCS Inventory NG Server version 2.12.3 and prior contain a s…6.1
• CVE-2026-22676Barracuda RMM versions prior to 2025.2.2 contain a privilege…8.5
• CVE-2026-22677Hermes WebUI prior to 0.51.44 contains a path traversal vuln…6.5
• CVE-2026-22678Webmin before 2.641 contains a stored cross-site scripting v…5.4
• CVE-2026-22679Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 con…9.8
• CVE-2026-22680OpenViking versions prior to 0.3.3 contain a missing authori…6.9
• CVE-2026-22682OpenHarness prior to commit 166fcfe contains an improper acc…8.4
• CVE-2026-22683Windmill versions 1.56.0 through 1.614.0 contain a missing a…8.8
• CVE-2026-22685DevToys is a desktop app for developers. In versions from 2.…9.8
• CVE-2026-22686Enclave is a secure JavaScript sandbox designed for safe AI …10
• CVE-2026-22687WeKnora is an LLM-powered framework designed for deep docume…9.8