Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2021-34648

Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Saturday Drive Ninja Forms

  • 3.5.7 to ≤ 3.5.7affected

References