Description
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Ninja Forms | < 3.11.1 | 3.11.1 |
References
- https://wpscan.com/vulnerability/60b4d7fc-5d23-4dcf-bd7f-e202cabc2625/ exploit vdb-entry technical-description