CVE-2025-10498

The Ninja Forms plugin for WordPress has a security flaw that allows attackers to trick an administrator into performing certain actions, such as deleting files, without needing to be authenticated. This happens because the plugin doesn't properly check for a security token, known as a nonce, when exporting CSV files. As a result, an attacker can craft a malicious link that an administrator will click on, leading to unintended file deletion.

Based on public CVE data (MITRE/NVD).