CVE-2021-24166CWE-352

Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection

published April 5, 2021

CVSS
—
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-04-05T18:27Z
EPSS history
Timeline
  • 05 APR 18:27Z
    Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection
    cvelistv5