CVE-2026-65050 is a missing authorization vulnerability in the Ninja Forms WordPress plugin (up to version 3.14.8). The issue exists in the render callback of the `ninja-forms/submissions-table` Gutenberg block, which does not properly restrict access. Authenticated users with Author-level privileges can embed this block with arbitrary formIDs on published posts, thereby exposing stored form submissions to unauthenticated visitors. The vulnerability is exacerbated by the exposure of a signed bearer token injected into visitors' browsers via `wp_localize_script`, which can be used to query the REST API submissions endpoint and retrieve all saved form submission fields, including sensitive personal data.

An attacker with Author-level access can expose sensitive personally identifiable information submitted through Ninja Forms to unauthenticated visitors. This includes names, email addresses, and phone numbers stored in form submissions. The vulnerability compromises confidentiality of user data collected via the plugin. There is no indication of privilege escalation or remote code execution, but the exposure of sensitive data poses significant privacy risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level user permissions to trusted users only and avoid embedding the `ninja-forms/submissions-table` block with arbitrary formIDs on publicly accessible posts. Monitor for vendor updates and apply patches promptly once available.