CVE-2026-65050 is a missing authorization vulnerability in the Ninja Forms WordPress plugin (version 3.14.8 and prior). The issue exists in the render callback of the ninja-forms/submissions-table Gutenberg block, which does not properly restrict access based on user privileges. Authenticated users with Author-level permissions can embed this block with arbitrary formIDs on published posts, causing the exposure of stored form submissions to unauthenticated visitors. The vulnerability is exacerbated by the ability to retrieve a signed bearer token injected into visitors' browsers via wp_localize_script, which can be used to query the REST API submissions endpoint and access all saved form submission data, including sensitive personally identifiable information.

This vulnerability allows an authenticated user with Author-level privileges to expose sensitive form submission data to unauthenticated visitors. The exposed data can include personally identifiable information such as names, email addresses, and phone numbers. This can lead to privacy violations and potential misuse of sensitive user data. The CVSS 4.0 score of 7.1 indicates a high severity impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user permissions to trusted users only and avoid embedding the ninja-forms/submissions-table block with arbitrary formIDs on publicly accessible posts. Monitor vendor channels for updates and apply patches promptly once released.