CVE-2024-2113
CVSS 3.1 Score 3.7 of 10 (low)
Details
Summary
CVE-2024-2113 is a Cross-Site Request Forgery vulnerability affecting the Ninja Forms Contact Form plugin for WordPress, versions up to 3.8.0. This issue arises from insufficient or missing nonce validation on the "nf\_download\_all\_subs" AJAX action. An attacker can exploit this vulnerability by triggering an export of a form's submission to a publicly accessible location, potentially putting sensitive data at risk. Successful exploitation depends on tricking a site administrator into performing a specific action, like clicking on a malicious link, making this a serious threat to WordPress websites.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions