WordPress CVEs

Description

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.

Affected WordPress components

• Ninja Forms – The Contact Form Builder That Grows With You Plugin · ninja-forms
  Confirmed match Active
  From 3.14.0 (including) to 3.15.2 (excluding)
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Ninja Forms — From 3.14.0 (including) to 3.15.2 (excluding)

References

• wpscan.com https://wpscan.com/vulnerability/befced17-95ff-4809-ad13-f63bc60e5670/
• nvd.nist.gov Official NVD record