The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Metrics
Affected Vendors & Products
References
History
Tue, 31 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Sun, 29 Dec 2024 05:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. | |
Title | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution | |
Weaknesses | CWE-94 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-12-29T05:22:53.627Z
Updated: 2024-12-31T17:03:31.881Z
Reserved: 2024-12-05T12:01:07.636Z
Link: CVE-2024-12238
Vulnrichment
Updated: 2024-12-31T17:03:27.778Z
NVD
Status : Received
Published: 2024-12-29T06:15:05.487
Modified: 2024-12-29T06:15:05.487
Link: CVE-2024-12238
Redhat
No data.