Vulnerability · Published Sep 22, 2021 · Assigned by Wordfence

CVE-2021-34647Ninja Forms <= 3.5.7 Sensitive Information Disclosure

Medium 6.5

In plain English

A medium-severity incorrect authorization in Ninja Forms from Saturday Drive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.2%top 32.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.

Affected products (as reported)

Vendor	Product	Versions
Saturday Drive	Ninja Forms	3.5.7 – through 3.5.7

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References