Security readout for executives and security teams
Plain-English summary
CVE-2021-34647 lets a logged-in attacker export Ninja Forms submission data from vulnerable WordPress sites. That data can include personally identifiable information submitted through forms. The issue is confidentiality-focused: the sources do not describe data modification, site takeover, or service disruption.
Executive priority
Treat as a timely remediation item for any WordPress site collecting sensitive form data. It is not marked actively exploited in the provided sources, but unauthorized export of PII can create privacy, customer trust, and notification risk.
Technical view
Ninja Forms versions up to and including 3.5.7 lacked proper authorization around the bulk submission export function in includes/Routes/Submissions.php. An authenticated low-privilege user could access the submissions export REST route and obtain all form submissions. CVSS 3.1 is 6.5 with high confidentiality impact.
Likely exposure
Exposure is limited to WordPress sites using Ninja Forms up to 3.5.7 where an attacker can authenticate. Sites collecting customer, lead, health, financial, or employee data through forms have higher business impact.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Risk comes from low attack complexity, network reachability, and the broad use of Ninja Forms noted by Wordfence, but authentication is required.
Researcher notes
This is a CWE-863 authorization failure in the submissions export path. The key validation point is whether the export route enforces appropriate capability checks in the installed plugin version. Avoid assuming exploit activity without external evidence.
Mitigation direction
- Upgrade Ninja Forms to a vendor-patched version newer than 3.5.7.
- Review vendor and WordPress plugin guidance for the exact fixed release.
- Restrict WordPress account creation and remove unnecessary low-privilege users.
- Limit form submission retention to data the business still needs.
- Review logs for unexpected submission exports by authenticated users.
Validation and detection
- Inventory WordPress sites using Ninja Forms and record installed versions.
- Confirm no production site runs Ninja Forms 3.5.7 or older.
- Review users with login access, especially subscriber-level or inactive accounts.
- Check whether sensitive data is stored in historical form submissions.
- Look for unusual access to Ninja Forms submission export functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-34647 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/blog/2021/09/recently-patched-vulnerabilities-in-ninja-forms-plugin-affects-over-1-million-site-owners/CVE reference · x_refsource_MISC
- https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Routes/Submissions.php?rev=2543837#L107CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.