CVE-2026-15159 is an insecure direct object reference vulnerability in the Ninja Forms - Excel Export WordPress plugin. The vulnerability arises from missing validation on the user-controlled 'spreadsheet_export_form_id' parameter, enabling authenticated users with low privileges to access and download submission data from any form by enumerating form IDs. This exposes sensitive user data collected via site forms. The issue affects all plugin versions up to and including 3.3.6. No official patch or remediation guidance is currently provided by the vendor.

Authenticated attackers with subscriber-level or higher access can bypass authorization controls to enumerate form IDs and download all stored submission data, including sensitive personally identifiable information. This exposure risks data confidentiality but does not affect data integrity or availability. The CVSS score of 4.3 reflects a medium severity impact primarily on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only and monitor for unusual export activity. Consider disabling the Excel Export functionality if feasible to reduce risk.