Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure
CVE-2021-24164
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 5 April 2021
What is CVE-2021-24164?
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
Affected Version(s)
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress 3.4.34.1