---
id: CVE-2026-80438
title: >-
  The Ninja Forms  WordPress plugin before 3.15.2 does not restrict its REST
  abilities to administrators, accepting a Ninja Forms  WordPress plugin before
  3.15.2-specific capability as equivalent to full site administration, which
  allows a…
summary: >-
  The Ninja Forms  WordPress plugin before 3.15.2 does not restrict its REST
  abilities to administrators, accepting a Ninja Forms  WordPress plugin before
  3.15.2-specific capability as equivalent to full site administration, which
  allows a…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N'
cwe:
  - CWE-284
published: '2026-09-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T19:15:18.627'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80438'
references:
  - url: 'https://wpscan.com/vulnerability/befced17-95ff-4809-ad13-f63bc60e5670/'
    label: contact@wpscan.com
tags:
  - nvd
epss: 0.00227
epssPercentile: 0.11968
ingestedAt: '2026-09-08T20:10:03.163Z'
---

## Overview

The Ninja Forms  WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms  WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms  WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms  WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages.
The capability belongs to no default WordPress role and the Ninja Forms  WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.