PT-2021-15710 · WordPress · Ninja Forms Contact Form
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Ninja Forms Contact Form WordPress plugin versions prior to 3.4.34.1
Description:
The issue allows low-level users, such as subscribers, to trigger the
wp ajax nf oauth action and retrieve the connection URL needed to establish a connection. They can also retrieve the client id for an already established OAuth connection.Recommendations:
For versions prior to 3.4.34.1, update to version 3.4.34.1 or later to resolve the issue.
Exploit
Fix
Missing Authorization
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ninja Forms Contact Form