CVE-2025-14072

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Jan 2, 2026

CISA due date

—

The record

The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.

Affected packages

Ecosystem	Package	Introduced	Fixed