Log out
Get PRO

Latest

Input validation vulnerability in Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress 3.0

  • Severity: critical
  • Status: Fixed
  • Publication: June 15, 2022

The Ninja Forms Contact Form plugin for WordPress is vulnerable to code injection in versions up to and including 3.6.10. This is because it does not validate certain inputs, called Merge Tags, properly, which can allow dangerous code to be executed. The most severe outcome of this is that it could allow an attacker to take control of the site remotely. Sites with a POP chain are particularly vulnerable to this type of attack.

Detected in:

Ninja Forms – The Contact Form Builder That Grows With You fixed vulnerable versions:
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress fixed vulnerable versions: >= * <= 3.0.34.1

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.