CVE-2024-2113 - Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export

Back Back to CVE browser

MEDIUM

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export

Published Mar 29, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products

Vendor Kstover Product Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=3.8.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kstover

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

unaffected

Version	Status	Constraints
-	affected	<=3.8.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-79

Cross-site Scripting (XSS)

References (2)

Link	Providers	Tags
https://plugins.trac.wordpress.org/changeset/3059780/ninja-forms/trunk/includes/Admin/CPT/DownloadAllSubmissions.php		Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/3ebfc9f5-abb7-47bc-bd38-f60df1cccb5d?source=cve		Third Party Advisory