PT-2024-15748 · WordPress · The Ninja Forms Contact Form – The Drag/Drop Form Builder For Wordpress

Matthew Rollings

+1

·

Published

2024-02-01

·

Updated

2024-08-22

·

CVE-2024-0685

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress versions up to, and including, 3.7.1
Description The issue is related to Second Order SQL Injection via the email address value submitted through forms due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional data into the already existing query when an administrator triggers a personal data export. The plugin has over 800,000 installs.
Recommendations For versions up to, and including, 3.7.1, update to a version later than 3.7.1 to resolve the issue. As a temporary workaround, consider restricting the input for the email address field to prevent SQL injection until a patch is available. Restrict access to the personal data export feature to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-0685

Affected Products

The Ninja Forms Contact Form – The Drag/Drop Form Builder For Wordpress