CVE-2026-2268 is a sensitive information exposure vulnerability in the Ninja Forms WordPress plugin (up to version 3.14.0). The issue arises from the unsafe application of the ninja_forms_merge_tags filter to user-supplied input within repeater fields, which allows unauthenticated attackers to resolve {post_meta:KEY} merge tags without authorization checks. This enables attackers to extract arbitrary post metadata, including sensitive data such as WooCommerce billing emails, API keys, private tokens, and customer personal information, through the nf_ajax_submit AJAX action. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) and is identified as CWE-200.

An unauthenticated attacker can exploit this vulnerability to access sensitive information stored as post metadata on the affected WordPress site. This includes potentially sensitive customer data and secret tokens, which could lead to privacy violations and further security risks if leveraged in subsequent attacks. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the nf_ajax_submit AJAX action or limiting the use of repeater fields that utilize the ninja_forms_merge_tags filter. Monitor vendor channels for updates and apply patches promptly once released.