CVE-2023-38386 is a high severity (CVSS 7.6) missing authorization flaw in the Ninja Forms WordPress plugin, versions through 3.6.25, that contributor accounts can reach. Patchstack lists 3.6.26 as the patched version, so update every site to version 3.6.26 or later today.
What's affected
The affected product is the Ninja Forms plugin for WordPress, published by Saturday Drive, in all versions through 3.6.25. The weakness is missing authorization. The record is dated 2024-06-19 and scores 7.6, High, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.
Patchstack's entry for this CVE lists the vulnerable versions as 3.6.25 and below, the required privilege as Contributor, and 3.6.26 as the patched version. Patchstack rates its own priority as Low, even though the score is 7.6. The same plugin has a sibling record, CVE-2023-38393, that needs only a Subscriber account, and Patchstack rates that one High priority.
Weakness class: CWE-862.
How to check if you're exposed
With WP-CLI, read the version.
wp plugin list --name=ninja-forms --fields=name,version,status,update
Or check Plugins in the admin screen. Versions 3.6.25 and below are affected, and 3.6.26 or later contains the fix per Patchstack. Then review the list of users with Contributor access and above.
What to do now
- Find every site that runs Ninja Forms and note the version.
- Update to 3.6.26 or later, preferably the current release.
- Review contributor accounts and remove any you cannot account for.
- Apply the same update for the sibling issue, CVE-2023-38393, which needs only a Subscriber account.
- Check form settings, submissions and notification addresses for unexpected changes.
Why it matters
Forms plugins hold submitted personal data and send notifications, so a flaw in who can read or change them has real impact. With missing authorization, a contributor can reach actions that were meant for editors or administrators. The vector shows high confidentiality impact, which fits access to form data.
Because the same range was affected by a second flaw reachable by subscribers, updating to 3.6.26 closes both. The risk grows if your site lets visitors register. The CVE is not on the CISA Known Exploited Vulnerabilities list, and Patchstack does not describe exploitation.
Missing authorization means the code performs an action for a logged-in user without checking that this user is allowed to do it. In WordPress plugins this often shows up as an AJAX or REST handler that checks the request is authenticated, or a nonce is valid, but never checks the user's capability. Low-privilege accounts such as subscribers and contributors can then reach functions meant for administrators.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. Plugins installed on a live WordPress site are better tracked with WP-CLI or your hosting dashboard, so use both.
Quick check
Is there another CVE for this version range?
Yes, CVE-2023-38393 covers the same versions and needs a Subscriber account. Updating to 3.6.26 addresses both.
What does the vector say about impact?
High confidentiality, low integrity and low availability.
Sources
Last reviewed: 19 October 2026.
