Ninja Forms Excel Export <= 3.3.6 Insecure Direct Object Reference (CVE-2026-15159)

Vulnerability Overview Vulnerability Name: Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter CVE ID: CVE-2026-15159 CVSS Score: 4.3 (Medium) Release Date: July 16, 2026 Last Updated: July 17, 2026 Researchers: Chu Thao Mai Affected Software Software Type: Plugin Software Slug: ninja-forms-excel-export Fixed: Yes Affected Versions: <= 3.3.6 Fixed Version: 3.3.7 Remediation Recommendation: Update to version 3.3.7 or later patched versions Description The Ninja Forms - Excel Export plugin contains an insecure direct object reference vulnerability affecting all versions up to 3.3.6. An attacker can control the 'spreadsheet_export_form_id' parameter to access and enumerate all Ninja Forms form IDs at the subscriber level, allowing them to download all stored submission data, including names, email addresses, phone numbers, physical addresses, and any PII data collected by the site, as a downloadable XLSX file. References plugins.trac.wordpress.org Additional Information Authorization Bypass via User-Controlled Key: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Related Vulnerabilities 1. Title: Ninja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter - CVE ID: CVE-2026-15161 - CVSS Score: 6.4 - Researchers: Chu Thao Mai - Date: July 16, 2026 2. Title: Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal - CVE ID: CVE-2026-15160 - CVSS Score: 4.3 - Researchers: Chu Thao Mai - Date: July 16, 2026 Copyright Copyright: © 2012-2026 Defect Inc. All Rights Reserved Business Hours: 9am-5pm ET, 6am-3pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support, 365 days a year, 1-hour response time Contact Technical Support: support@wordfence.com Other Resources Wordfence Intelligence: Provides a free WordPress vulnerability database and webhook integration Wordfence Plugin: Install the Wordfence plugin to receive instant notifications Documentation: View documentation to learn how to access and use the vulnerability data API Social Media Facebook: Wordfence Twitter: @Wordfence LinkedIn: Wordfence Email: Wordfence Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Products and Support Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscribe for Updates Subscribe: Sign up for news and updates Other Wordfence Intelligence WordPress Vulnerability Database: Full free access and use to query and consume vulnerability data via API Wordfence Intelligence WordPress Vulnerability Database: Full free access and use to query and consume vulnerability data via API

Goal Reached Thanks to every supporter — we hit 100%!

Ninja Forms Excel Export <= 3.3.6 Insecure Direct Object Reference (CVE-2026-15159)

More from this source