CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unauthenticated attackers to delete those files granted they can trick an administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
Ninja Forms versions up to 3.12.0 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, executes unwanted form modifications or settings changes. The vulnerability requires no special privileges but does require the admin to click a link or visit a page controlled by the attacker.
What an attacker can do
Perform unauthorized actions on Ninja Forms (like modifying forms or settings) when an admin visits a malicious page.
Potential impact on your site
An attacker can modify your contact forms or Ninja Forms settings without your knowledge if you visit a malicious link.
Conditions required to exploit
Admin must visit a page or click a link controlled by the attacker; no special authentication or privileges needed.
Key dates
External resources
