CVE-2024-12238: Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12238?
CVE-2024-12238 is considered a critical vulnerability as it allows arbitrary shortcode execution.
How do I fix CVE-2024-12238?
To fix CVE-2024-12238, you should update the Ninja Forms plugin to version 3.8.23 or later.
What versions of Ninja Forms are affected by CVE-2024-12238?
CVE-2024-12238 affects all versions of Ninja Forms up to and including 3.8.22.
What kind of attack can exploit CVE-2024-12238?
CVE-2024-12238 can be exploited through arbitrary shortcode execution which may lead to unauthorized access or site compromise.
Is there a patch for CVE-2024-12238?
Yes, a patch is included in Ninja Forms version 3.8.23 which resolves the vulnerability.