CVE-2026-80438: CWE-284 Improper Access Control in Ninja Forms

CVE-2026-80438 is an improper access control vulnerability in the Ninja Forms WordPress plugin before version 3.15.2. The plugin incorrectly treats a Ninja Forms-specific capability as equivalent to full site administration in its REST API, allowing any user with that capability to access sensitive plugin settings and data, overwrite configuration, and create or modify arbitrary posts and pages. Since the capability is not granted by default, exploitation requires an administrator to have delegated this capability to a user, typically to allow form building.

An attacker with the delegated Ninja Forms capability can read sensitive plugin settings and stored form submissions, modify the plugin's configuration, and create or alter arbitrary WordPress posts and pages. This could lead to unauthorized data disclosure and content manipulation within the affected WordPress site. However, exploitation requires prior assignment of the capability by an administrator, limiting the scope to delegated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully review and restrict assignment of the Ninja Forms-specific capability to trusted users only. Avoid delegating this capability unless necessary, and monitor user roles and permissions related to Ninja Forms.