Vulnerabilities > CVE-2022-2903 - Deserialization of Untrusted Data vulnerability in Ninjaforms Ninja Forms

047910
CVSS 7.2 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
HIGH
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
ninjaforms
CWE-502

Summary

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

Vulnerable Configurations

Part Description Count
Application
Ninjaforms
286

Common Weakness Enumeration (CWE)