CVE-2021-24163
High
Description
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Ninjaforms Ninja Forms
PublishedApr 5, 2021
First seenApr 5, 2021
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- ninjaforms ninja_forms3.4.34 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ninjaforms ninja_forms | v < 3.4.34 | 3.4.34 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.