CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.
Explanation of Vulnerability in Simple Terms
Ninja Forms - Excel Export versions 3.3.6 and earlier contain a path traversal vulnerability that allows authenticated users to write files outside the intended directory. An attacker with low-level site access can manipulate file paths during export operations to place files in arbitrary locations on the server, potentially overwriting critical files or injecting malicious code.
What an attacker can do
Write or overwrite files outside the intended export directory on the server.
Potential impact on your site
Malicious users could overwrite configuration files, inject code, or deface your site if they have basic account access.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
