CVE-2021-24164
PoC —CVSS 3.1
4.3 medium
EPSS
<1%p57
Published
()
Modified
Description
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
- Vendors
- ninjaforms
- Products
- ninja forms
- Ecosystems
- WordPress
- Weakness
- CWE-200, CWE-862
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
In the news0 stories
No ingested article mentions this CVE yet.