WordPress Ninja Forms plugin <= 3.6.10 - Unauthenticated PHP Object Injection

[Kailash]

WordPress Ninja Forms Contact Form plugin <= 3.6.10 - Unauthenticated PHP Object Injection vulnerability

Plugin name: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Vulnerable versions: <= 3.6.10
Fixed in: 3.6.11
CVE ID: N/A
Classification: PHP Object Injection
Publicly disclosed: 2022-06-15

Vulnerability Details

Unauthenticated PHP Object Injection vulnerability discovered in WordPress Ninja Forms plugin (versions <= 3.6.10).

Solution

Update the WordPress Ninja Forms plugin to the latest available version (at least 3.6.11).

Plugin Link: https://wordpress.org/plugins/ninja-forms/