CVE-2021-24164CWE-200

Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure

published April 5, 2021

CVSS
—
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00889 · 59.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2021-04-05T18:27Z
EPSS history
Timeline
  • 05 APR 18:27Z
    Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure
    cvelistv5