CVE-2021-24165

In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

EPSS

1.64% chance of exploitation in the next 30 days, 75th percentile

Nuclei

medium · CWE-601

Published

2021-04-05

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24165.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-24164
• CVE-2021-24166
• CVE-2021-24163
• CVE-2021-24168
• CVE-2021-24162
• CVE-2021-24169