CVE-2023-38386 is a critical missing authorization vulnerability affecting Ninja Forms versions up to and including 3.6.25, allowing unauthenticated attackers to steal submitted data. With a CVSS score of 9.8, it presents a network-exploitable, low-complexity attack with high impact on confidentiality, integrity, and availability. While not currently listed in KEV or having public exploit code, it has garnered significant community discussion and media coverage, indicating potential for future exploitation. Organizations using affected Ninja Forms versions should prioritize patching to mitigate this severe risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.6.26CPE matchmatch criteria | cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:* | ||
<= 3.6.25CPE match | cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.