PT-2024-28564 · WordPress · Ninja Forms

Rafie Muhammad · Published 2024-08-26 · Updated 2024-10-20 · CVE-2024-39628

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ninja Forms versions prior to 3.8.7

Description A Cross-Site Request Forgery (CSRF) issue affects the Ninja Forms plugin, allowing unauthorized actions to be performed on behalf of a user. This issue can be exploited by an attacker to perform actions without the user's knowledge or consent. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 3.8.7, update to version 3.8.7 to resolve the issue. As a temporary workaround, consider implementing additional security measures to mitigate the risk of Cross-Site Request Forgery, such as validating user requests and ensuring that sensitive actions require explicit user confirmation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-39628

Affected Products

Ninja Forms

References · 8

• https://osv.dev/vulnerability/CVE-2024-39628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39628 · Security Note
• https://t.me/cvenotify/98901 · Telegram Post
• https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/92274 · Telegram Post
• https://twitter.com/transilienceai/status/1829198829758894178 · Twitter Post
• https://twitter.com/CVEnew/status/1828179175229853947 · Twitter Post
• https://twitter.com/transilienceai/status/1829585159701578216 · Twitter Post