Not rated
CVE-2021-24163 The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it…
Description
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress 3.4 | earliest → < 3.4.34 | 3.4.34 |
Other CVEs of Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
The 9 CVEs of Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress →
CVE-2022-2903
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could…
7.2
High
CVE-2021-25066
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing…
Not rated
CVE-2021-25056
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high…
Not rated
CVE-2021-24889
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which…
Not rated