CVE-2021-24889

Ninja Forms < 3.6.4 - Admin+ SQL Injection

The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks

Affected

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.32% chance of exploitation in the next 30 days, 70th percentile

Published

2021-11-29

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/55008a42-eb56-436c-bce0-10ee616d0495

References

• CVE Record
• NVD entry