CVE-2021-24163

Name of the Vulnerable Software and Affected Versions: SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress versions prior to 3.4.34

Description: The issue arises from the lack of capability checks and nonce protection in the AJAX action wp ajax ninja forms sendwp remote install handler. This allows low-level users, such as subscribers, to install and activate the plugin, and also retrieve the client secret key needed for establishing the SendWP connection.

Recommendations: For versions prior to 3.4.34, update to version 3.4.34 or later to resolve the issue. As a temporary workaround, consider disabling the wp ajax ninja forms sendwp remote install handler AJAX action until a patch is available. Restrict access to the client secret key to minimize the risk of exploitation.