The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864 | Exploit Patch Third Party Advisory |
https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864 | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 07:01
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864 - Exploit, Patch, Third Party Advisory |
Information
Published : 2022-09-26 13:15
Updated : 2024-11-21 07:01
NVD link : CVE-2022-2903
Mitre link : CVE-2022-2903
CVE.ORG link : CVE-2022-2903
JSON object : View
Products Affected
ninjaforms
- ninja_forms
CWE
CWE-502
Deserialization of Untrusted Data