Vulnerability · Published Sep 26, 2022 · Assigned by WPScan
CVE-2022-2903NinjaForms < 3.6.13 - Admin+ PHP Objection Injection
High 7.2
In plain English
A high-severity unsafe deserialization in Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.4%top 26.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress | 3.6.13 – before 3.6.13 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H