CVE-2016-1209

Published: May 14, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.

Affected (1)

Products: Ninjaforms: Ninja Forms

Ninjaforms

1 product

Ninja Forms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ninjaforms Ninja Forms	Up to 2.9.42

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (16)

http://jvn.jp/en/jp/JVN44657371/index.html

Source: vultures@jpcert.or.jp

Vendor Advisory

http://jvndb.jvn.jp/jvndb/JVNDB-2016-000064

Source: vultures@jpcert.or.jp

Vendor Advisory

http://packetstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.html

Source: vultures@jpcert.or.jp

Exploit

http://www.pritect.net/blog/ninja-forms-2-9-42-critical-security-vulnerabilities

Source: vultures@jpcert.or.jp

http://www.rapid7.com/db/modules/exploit/unix/webapp/wp_ninja_forms_unauthenticated_file_upload

Source: vultures@jpcert.or.jp

Exploit

https://ninjaforms.com/important-security-update-always-hurt-ones-love/

Source: vultures@jpcert.or.jp

https://wordpress.org/plugins/ninja-forms/changelog/

Source: vultures@jpcert.or.jp

https://wpvulndb.com/vulnerabilities/8485

Source: vultures@jpcert.or.jp

http://jvn.jp/en/jp/JVN44657371/index.html