CVE-2022-2903CWE-502

NinjaForms < 3.6.13 - Admin+ PHP Objection Injection

High · published September 26, 2022

CVSS v3.1
7.2
EPSS
1%
Percentile
73.1
In the wild
Unconfirmed
What it is

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01446 · 73.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2022-09-26T12:35Z
EPSS history
Timeline
  • 26 SEP 12:35Z
    NinjaForms < 3.6.13 - Admin+ PHP Objection Injection
    cvelistv5