What the vulnerability does
01Description
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possible for unauthenticated attackers to opt an affected site into usage statistics collection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Ninja Forms versions up to 3.12.0 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, executes unwanted form modifications or settings changes. The vulnerability requires user interaction—the admin must click the link or visit the attacker's page while logged in.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on Ninja Forms (like modifying forms or settings) by tricking an admin into clicking a malicious link.
Potential impact on your site
04Site Impact
Form configurations could be altered or deleted without your knowledge if an admin visits a compromised site.
Conditions required to exploit
05Prerequisites
Admin must visit attacker-controlled page or click a malicious link while logged into WordPress.
Key dates
06Disclosure timeline
September 27, 2025
CVE published
April 8, 2026
Record updated
