What the vulnerability does
01Description
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate any Ninja Forms form ID and download all stored submission data — including names, email addresses, phone numbers, physical addresses, and any other PII collected by site forms — as a downloadable XLSX file.
Explanation of Vulnerability in Simple Terms
02Summary
Ninja Forms - Excel Export versions 3.3.6 and earlier allow authenticated users to read sensitive data they should not have access to. The vulnerability requires a valid user account but no special privileges. An attacker with low-level access can view confidential information through the export functionality. Update to a version newer than 3.3.6.
What an attacker can do
03Attacker Capabilities
Read sensitive data from the site that they should not have access to.
Potential impact on your site
04Site Impact
User data may be exposed to authenticated attackers with basic site access.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level privileges on the site.
Key dates
06Disclosure timeline
July 17, 2026
CVE published
