Anmelden
Deutsch English Español Polski
Mittel

Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion

  • Veröffentlicht: 22.06.2023
  • Aktualisiert: 11.10.2026 10:23

The Ninja Forms plugin for WordPress is vulnerable to arbitrary file deletions in versions up to, and including, 3.6.24. This is due to insufficient restriction on the file path that can be supplied during file deletion. This makes it possible for authenticated attackers, with administrative-level access, to delete arbitrary files on the server. One such file that could be targeted is wp-config.php which if deleted can make it possible for an attacker to connect a site to their own database and ultimately achieve remote code execution on the server.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
WordPress-Plugin Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.6.24 3.6.25

Verweise

CVSS-Wert 6.5/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Schwäche (CWE)
CWE-73
Plattform
WordPress
Paket
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
Veröffentlicht
22.06.2023
Aktualisiert
11.10.2026 10:23

Quellen und Lizenzen

Wordfence Intelligence - e97479b1-06a0-4e24-9d2b-005bdfec9eaf - Wordfence Intelligence

Copyright 1999-2026 The MITRE Corporation

Copyright 2012-2026 Defiant Inc.

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse
Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc.
Copyright Defiant, Inc. All rights reserved except as granted below.
License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026):

Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy.

Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Schwachstellenhistorie: Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

Alle veröffentlichten Schwachstellen dieses Pakets (WordPress-Plugin), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (88) im Archiv
Einträge insgesamt
88
Erste → letzte
11.2014 10.2026
Ohne Fix
0
In Angriffen ausgenutzt
0

Verteilung nach Schweregrad

  • Kritisch 3
  • Hoch 26
  • Mittel 58
  • Niedrig 1

Veröffentlichungen pro Jahr

früher: 11

Schweregrad:
  1. Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
    Hoch · 7.2 CVE-2026-90438 <= 3.15.4 3.15.5
  2. Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
    Hoch · 7.2 CVE-2026-102385 <= 3.15.3 3.15.5
  3. Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
    Hoch · 7.2 CVE-2026-95515 <= 3.15.3 3.15.4
  4. Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection
    Hoch · 8.1 CVE-2026-91827 <= 3.15.3 3.15.4
  5. Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
    Hoch · 7.2 CVE-2026-92438 <= 3.15.3 3.15.4
  6. Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
    Hoch · 7.2 CVE-2026-94504 <= 3.15.3 3.15.4
  7. Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
    Hoch · 7.2 CVE-2026-19769 <= 3.15.1 3.15.2
  8. Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
    Hoch · 7.5 CVE-2026-1239 <= 3.14.1 3.14.2
  9. Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
    Hoch · 7.5 CVE-2026-2268 <= 3.14.0 3.14.1
  10. Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
    Hoch · 7.5 CVE-2025-11924 <= 3.13.2 3.13.3
  11. Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure
    Hoch · 7.5 CVE-2025-14072 <= 3.13.2 3.13.3
  12. Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection
    Hoch · 8.1 CVE-2025-9083 <= 3.11.0 3.11.1
  13. Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations
    Hoch · 7.2 CVE-2024-11052 <= 3.8.19 3.8.20
  14. Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion dieser Eintrag
    Mittel · 6.5 CVE-2023-36505 <= 3.6.24 3.6.25
  15. Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection
    Hoch · 7.2 CVE-2022-2903 <= 3.6.12 3.6.13
  16. Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection
    Kritisch · 9.8 df46b3d5-a433-47b5-99b8-117591f7dd16 <= 3.0.34.1, >= 3.1, <= 3.1.9, >= 3.2, <= 3.2.27, >= 3.3, <= 3.3.21.3, >= 3.4, <= 3.4.34.1, >= 3.5, <= 3.5.8.3, >= 3.6, <= 3.6.10 3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11
  17. Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection
    Hoch · 8.8 488970f0-3120-4f4a-9915-2ae1708bd86a <= 3.6.9 3.6.10
  18. Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection
    Hoch · 7.2 CVE-2021-24889 < 3.6.4 3.6.4
  19. Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
    Hoch · 8.8 CVE-2021-24163 < 3.4.34 3.4.34
  20. Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation
    Hoch · 8.8 CVE-2020-36174 <= 3.4.27 3.4.27.1
  21. Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection
    Kritisch · 9.8 CVE-2019-15025 <= 3.3.21.1 3.3.21.2
  22. Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting
    Hoch · 8.3 aa735320-f7fe-4e51-9f9a-f4c8f3ddc2e7 < 3.3.14 3.3.14
  23. Ninja Forms Contact Form <= 3.3.13 - CSV Injection
    Hoch · 8.6 CVE-2018-16308 <= 3.3.13 3.3.14
  24. Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests
    Kritisch · 9.1 CVE-2018-20981 <= 3.3.8 3.3.9
  25. Ninja Forms Contact Form <= 3.2.14 - Parameter Tampering
    Hoch · 7.5 CVE-2018-20980 < 3.2.15 3.2.15
  26. Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection
    Hoch · 8.8 89a44d42-a110-4f55-ad27-2be4ccb41a16 < 2.9.55.2 2.9.55.2
  27. Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection
    Hoch · 8.1 CVE-2016-1209 >= 2.9.36, <= 2.9.42 2.9.42.1
  28. Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting
    Hoch · 7.2 7bd89bd9-4f99-4828-bacc-15d2cfe13066 <= 2.9.28 2.9.29
  29. Ninja Forms Contact Form <= 2.9.27 - CSV Injection
    Hoch · 8.4 39b6a1c7-2f8a-49e9-8807-a53a25524018 <= 2.9.27 2.9.28
  30. Ninja Forms Contact Form <= 2.8.8 - Stored Cross-Site Scripting
    Hoch · 7.2 CVE-2015-2220 < 2.8.9 2.8.9

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.