WordPress Community Forum
WordPress Support => WordPress Vulnerability => Topic started by: Kailash on Jun 16, 2022, 06:24 AM
WordPress Ninja Forms Contact Form plugin <= 3.6.10 - Unauthenticated PHP Object Injection vulnerability
Plugin name: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Vulnerable versions: <= 3.6.10
Fixed in: 3.6.11
CVE ID: N/A
Classification: PHP Object Injection
Publicly disclosed: 2022-06-15
Vulnerability Details
Unauthenticated PHP Object Injection vulnerability discovered in WordPress Ninja Forms plugin (versions <= 3.6.10).
Solution
Update the WordPress Ninja Forms plugin to the latest available version (at least 3.6.11).
Plugin Link: https://wordpress.org/plugins/ninja-forms/