The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864 | Exploit Patch Third Party Advisory |
Configurations
History
No history.
Information
Published : 2022-09-26 13:15
Updated : 2024-02-28 19:29
NVD link : CVE-2022-2903
Mitre link : CVE-2022-2903
CVE.ORG link : CVE-2022-2903
JSON object : View
Products Affected
ninjaforms
- ninja_forms
CWE
CWE-502
Deserialization of Untrusted Data