CVE-2026-65050

The Ninja Forms WordPress plugin, versions 3.14.8 and earlier, has a security flaw that allows authorized users with Author-level access to share sensitive information with anyone. By inserting a specific Gutenberg block into a published post, these users can expose stored form submissions to visitors who are not logged in. The vulnerability allows attackers to obtain a signed token that can be used to access sensitive data, such as names, email addresses, and phone numbers, stored in form submissions.

Based on public CVE data (MITRE/NVD).