Ninja Forms File Uploads Extension
Monthly
Cross-Site Request Forgery in the Ninja Forms File Uploads Extension for WordPress (versions 3.3.26 and earlier) lets a remote, unauthenticated attacker forge state-changing requests that are executed with a victim's session when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack and rated CVSS 9.6 with a scope-changed, high-impact vector, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because it is a file-upload add-on, a successful forgery could result in unauthorized file uploads or configuration changes on the WordPress site.
Cross-Site Request Forgery in the Ninja Forms File Uploads Extension for WordPress (versions 3.3.26 and earlier) lets a remote, unauthenticated attacker forge state-changing requests that are executed with a victim's session when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack and rated CVSS 9.6 with a scope-changed, high-impact vector, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because it is a file-upload add-on, a successful forgery could result in unauthorized file uploads or configuration changes on the WordPress site.