CVE-2024-2113: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nfdownloadallsubs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2113?
CVE-2024-2113 is classified as a medium severity vulnerability due to its potential for exploitation through Cross-Site Request Forgery.
How do I fix CVE-2024-2113?
To fix CVE-2024-2113, update the Ninja Forms plugin to version 3.8.1 or later.
What versions are affected by CVE-2024-2113?
CVE-2024-2113 affects all versions of the Ninja Forms plugin up to and including version 3.8.0.
What is the impact of exploiting CVE-2024-2113?
Exploitation of CVE-2024-2113 can allow an attacker to perform unauthorized actions on behalf of the user without their consent.
Is CVE-2024-2113 fixed in future releases?
Yes, CVE-2024-2113 is fixed in version 3.8.1 of the Ninja Forms plugin.