CVE-2022-0888
published 2022-03-23CVE-2022-0888: The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the…
PriorityP275critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
39.39%
98.4th percentile
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ninjaforms | ninja_forms_file_uploads | <= 3.3.0 | — |
| saturdaydrive | ninja_forms_file_uploads | <= 3.3.0 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gist.github.com/Xib3rR4dAr/5f0accbbfdee279c68ed144da9cd8607https://www.wordfence.com/threat-intel/vulnerabilities/id/f00eeaef-f277-481f-9e18-bf1ced0015a0?source=cvehttps://www.wordfence.com/vulnerability-advisories/#CVE-2022-0888https://gist.github.com/Xib3rR4dAr/5f0accbbfdee279c68ed144da9cd8607https://www.wordfence.com/threat-intel/vulnerabilities/id/f00eeaef-f277-481f-9e18-bf1ced0015a0?source=cvehttps://www.wordfence.com/vulnerability-advisories/#CVE-2022-0888
2022-03-23
Published