CVE-2023-38393 is a high severity (CVSS 7.6) missing authorization flaw in the Ninja Forms WordPress plugin, through version 3.6.25, reachable by the lowest login role, Subscriber. Patchstack lists 3.6.26 as the patched version. Update every site to 3.6.26 or later.
What's affected
The affected product is the Ninja Forms plugin for WordPress, in all versions through 3.6.25. The weakness is missing authorization. The record is dated 2024-06-19 and scores 7.6, High, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. Its description is identical to the sibling record CVE-2023-38386, so the Patchstack entries are what tell the two apart.
Patchstack's entry for this CVE says the required privilege is Subscriber, which is the role every registered visitor gets by default. It lists 3.6.26 as the patched version and rates the priority High. The sibling entry for CVE-2023-38386 needs a Contributor account and is rated Low by Patchstack. Both are fixed in 3.6.26.
Weakness class: CWE-862.
How to check if you're exposed
Check the version with WP-CLI.
wp plugin list --name=ninja-forms --fields=name,version,status,update
Or look in the Plugins screen. Versions 3.6.25 and below are affected. Then check whether your site allows open registration, since every registered visitor would count as a Subscriber.
wp option get users_can_register
wp option get default_role
A value of 1 for the first, with subscriber for the second, means anyone can sign up for the role this flaw needs.
What to do now
- Update Ninja Forms to 3.6.26 or later on every site.
- Check whether open registration is enabled and turn it off if you do not need it.
- Review the list of registered users and remove accounts that look automated or unfamiliar.
- Review form settings, stored submissions and notification recipients for unexpected changes.
- Apply the same update for the Contributor-level sibling, CVE-2023-38386.
Why it matters
This is the same class as its sibling, with a lower bar. A Subscriber is the default role on a site that allows registration, and a site with open registration lets anyone obtain one. That moves the practical risk from needing a trusted insider to needing an email address.
Reducing exposure takes two steps. Update the plugin, and ask whether open registration is needed at all. If the site only has staff users, turning registration off removes a whole group of low-privilege flaws at once. The CVE is not on the CISA Known Exploited Vulnerabilities list, and Patchstack does not describe exploitation.
Missing authorization means the code performs an action for a logged-in user without checking that this user is allowed to do it. In WordPress plugins this often shows up as an AJAX or REST handler that checks the request is authenticated, or a nonce is valid, but never checks the user's capability. Low-privilege accounts such as subscribers and contributors can then reach functions meant for administrators.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the dependencies a code project declares. Plugins installed on a live WordPress site are better tracked with WP-CLI or your hosting dashboard, so use both.
Quick check
How is this different from CVE-2023-38386?
Same plugin, same versions and same fix. This one needs a Subscriber account, and the other needs a Contributor account.
Does turning off registration remove the risk?
It reduces it, but update anyway, since existing low-privilege accounts still count.
Sources
Last reviewed: 19 October 2026.
