Vulnerability · Published Mar 23, 2022 · Assigned by Wordfence
CVE-2022-0888Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload
Critical 9.8
In plain English
A critical-severity unrestricted file upload in Ninja Forms - File Uploads from SaturdayDrive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 39.4% (higher than 99% of all known vulnerabilities).
Official description
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SaturdayDrive | Ninja Forms - File Uploads | 0 – through 3.3.0 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H