CVE-2016-1209 Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection
CriticalCVSS 9.8
EPSS 61.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ninjaforms ninja forms | <= 2.9.42 | No fix listed |
| wordpress ninja-forms(WordPress) | >= 2.9.36, < 2.9.42.1 | 2.9.42.1 |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- JVN#44657371 third-party-advisory vendor-advisory
- JVNDB-2016-000064 third-party-advisory vendor-advisory
- packetstormsecurity.com exploit
- www.pritect.net
- www.rapid7.com exploit
- ninjaforms.com
- wordpress.org
- wpvulndb.com
- Wordfence Intelligence third-party-advisory