CVE-2026-15159: Ninja Forms Excel Export IDOR Vulnerability

CVE-2026-15159 Overview

CVE-2026-15159 is an Insecure Direct Object Reference (IDOR) vulnerability in the Ninja Forms - Excel Export plugin for WordPress. The flaw affects all versions up to and including 3.3.6. The plugin fails to validate a user-controlled key in the spreadsheet_export_form_id parameter. Authenticated attackers with subscriber-level access or higher can enumerate any Ninja Forms form ID and download stored submissions as XLSX files. Exposed data includes names, email addresses, phone numbers, physical addresses, and other personally identifiable information (PII) collected through site forms. The weakness maps to CWE-639 — Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated WordPress user with subscriber privileges can exfiltrate all form submission data, exposing PII collected across every Ninja Form on the site.

Affected Products

• Ninja Forms - Excel Export plugin for WordPress (all versions ≤ 3.3.6)
• WordPress sites running the plugin with subscriber-level registration enabled
• Any site collecting PII through Ninja Forms with the export plugin active

Discovery Timeline

• 2026-07-17 - CVE-2026-15159 published to NVD
• 2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-15159

Vulnerability Analysis

The vulnerability resides in the export handler of the Ninja Forms - Excel Export plugin. The handler accepts a spreadsheet_export_form_id parameter from the request and uses it directly to fetch and serialize form submissions into an XLSX file. The plugin does not verify whether the requesting user has authorization to access submissions for the referenced form. Any authenticated user, including low-privilege subscribers, can supply arbitrary form IDs and receive the corresponding submission data. Because Ninja Forms is used for contact forms, registration flows, and lead capture, the impacted data typically contains PII such as full names, email addresses, phone numbers, and physical addresses.

Root Cause

The root cause is missing authorization on a user-controlled identifier. The export function trusts the client-supplied spreadsheet_export_form_id parameter without performing a capability check such as current_user_can('manage_options') or verifying ownership of the target form. This is a textbook IDOR pattern classified under CWE-639. Reference the WordPress Plugin Code Review for the vulnerable code path.

Attack Vector

An attacker registers or authenticates as a subscriber-level user on the target WordPress site. The attacker then issues a request to the plugin's export endpoint, iterating the spreadsheet_export_form_id parameter through integer values. Each valid ID returns an XLSX download containing every submission stored for that form. The attack requires no user interaction and is fully automatable. See the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-15159

Indicators of Compromise

• Repeated authenticated HTTP requests to the plugin's export endpoint containing the spreadsheet_export_form_id parameter with sequentially incrementing values.
• Unexpected XLSX file downloads originating from subscriber-level accounts in web server access logs.
• Sudden spikes in outbound response bytes tied to form export URLs from non-administrative sessions.

Detection Strategies

• Review WordPress and web server logs for authenticated requests to the Ninja Forms Excel Export endpoint from users lacking administrative roles.
• Correlate HTTP request patterns showing enumeration behavior — sequential spreadsheet_export_form_id values from a single session or IP.
• Audit newly created subscriber accounts followed shortly by requests to plugin export handlers.

Monitoring Recommendations

• Enable verbose logging on the WordPress admin-ajax and REST endpoints handling plugin exports.
• Alert on any XLSX response served to users whose role is not administrator or editor.
• Track new user registrations from anonymous proxies or Tor exit nodes when open registration is enabled.

How to Mitigate CVE-2026-15159

Immediate Actions Required

• Deactivate the Ninja Forms - Excel Export plugin until a patched version is installed.
• Disable open WordPress user registration if it is not required for site functionality.
• Audit existing subscriber accounts and remove any that appear anomalous or unused.
• Review form submission data exposure and notify affected individuals if PII disclosure is confirmed under applicable privacy regulations.

Patch Information

At the time of publication, no vendor-supplied patched version is referenced in the NVD entry. Site administrators should monitor the plugin's WordPress.org page for a release above version 3.3.6 that adds capability checks to the export handler. Refer to the Wordfence Vulnerability Report for update tracking.

Workarounds

• Remove the plugin entirely if Excel export functionality is not business-critical.
• Restrict access to the plugin's export endpoint using web application firewall (WAF) rules that require administrator-level cookies.
• Apply a custom mu-plugin that calls wp_die() on the export action when current_user_can('manage_options') returns false.

# Example WAF rule concept (ModSecurity)
SecRule REQUEST_URI "@contains spreadsheet_export_form_id" \
  "id:1015159,phase:2,deny,status:403,\
   chain,msg:'Block Ninja Forms Excel Export IDOR (CVE-2026-15159)'"
  SecRule REQUEST_COOKIES:/wordpress_logged_in/ "!@rx ^.*administrator.*$"