CVE-2022-2903 — Deserialization of Untrusted Data in Ninja Forms

CWE-502 — Deserialization of Untrusted Data3 documents3 sources
Severity
7.2HIGHNVD
EPSS
0.8%
top 25.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ninjaforms Ninja Forms
Timeline
PublishedSep 26
Latest updateSep 27

Description

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages1 packages

Patches

Patch: wpscan.com ↗Patch: wpscan.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-h596-wmq7-7vpq: The Ninja Forms Contact Form WordPress plugin before 3↗2022-09-27
▶
CVEList
NinjaForms < 3.6.13 - Admin+ PHP Objection Injection↗2022-09-26
▶
CVE-2022-2903 — Deserialization of Untrusted Data | cvebase