"WordPress Ninja Forms Plugin Flaw Lets Hackers Steal Submitted Data"

Three vulnerabilities in the popular WordPress form-building plugin Ninja Forms could enable attackers to escalate privileges and steal user data. Patchstack disclosed the three vulnerabilities to the plugin's developer, Saturday Drive, warning that they affect NinjaForms versions 3.6.25 and older. In response, the developer released version 3.6.26 to address the vulnerabilities. However, only about half of NinjaForms users have downloaded the most recent version, leaving around 400,000 websites vulnerable to attack. The first flaw discovered by Patchstack is a POST-based reflected cross-site scripting (XSS) vulnerability that allows unauthenticated users to escalate their privileges and steal information by tricking privileged users into visiting a specially-crafted webpage. The second and third vulnerabilities are access control issues on the plugin's form submissions export feature, allowing Subscribers and Contributors to export all the data users have submitted on a vulnerable WordPress site. This article continues to discuss the three vulnerabilities contained by the popular WordPress Ninja Forms plugin. 

Bleeping Computer reports "WordPress Ninja Forms Plugin Flaw Lets Hackers Steal Submitted Data"