CVE-2021-24163

The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.44% chance of exploitation in the next 30 days, 71th percentile

Published

2021-04-05

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/55fde9fa-f6cd-4546-bee8-4acc628251c2

References

• CVE Record
• NVD entry

Related

• CVE-2021-24162
• CVE-2021-24164
• CVE-2021-24160
• CVE-2021-24165
• CVE-2021-24158
• CVE-2021-24166