Executive brief
The Ninja Forms - Excel Export plugin for WordPress, which allows site administrators to export form submissions to Excel files, contains a security flaw. This vulnerability allows any logged-in user, even those with minimal permissions like subscribers, to download all data submitted through any form on the website. This could lead to the exposure of sensitive customer information, including names, email addresses, and phone numbers, potentially resulting in privacy violations and reputational damage.
Technical details
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'spreadsheet_export_form_id' parameter in versions up to and including 3.3.6. The vulnerability stems from a lack of proper validation and authorization checks on the user-controlled form ID key. An authenticated attacker with subscriber-level permissions or higher can iterate through form IDs to generate and download XLSX files containing all submission data for any form on the site. This data typically includes personally identifiable information (PII) such as names, emails, and addresses. The issue is tracked as CWE-639.
Affected products
- SaturdayDrive Ninja Forms - Excel Export up to, and including, 3.3.6
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory