CVE-2024-2113

Summary

CVE-2024-2113 is a Cross-Site Request Forgery vulnerability affecting the Ninja Forms Contact Form plugin for WordPress, versions up to 3.8.0. This issue arises from insufficient or missing nonce validation on the "nf\_download\_all\_subs" AJAX action. An attacker can exploit this vulnerability by triggering an export of a form's submission to a publicly accessible location, potentially putting sensitive data at risk. Successful exploitation depends on tricking a site administrator into performing a specific action, like clicking on a malicious link, making this a serious threat to WordPress websites.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.