In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
| Link | Tags |
|---|---|
| https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/ | third party advisory |
| https://wpscan.com/vulnerability/dfa32afa-c6de-4237-a9f2-709843dcda89 | third party advisory exploit |