Threats tagged 'ghsa-3v9p-5xxf-6hxg'

The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.34 contains a vulnerability allowing unauthenticated attackers to perform arbitrary file read, write, and deletion operations via the external Amazon S3 upload flow. This occurs because the plugin trusts attacker-supplied file paths without validation, which can lead to remote code execution if the external store is configured. Exploitation requires the use of the External File Upload (Amazon S3) action, and for file read, an Email action attaching the uploaded file must be configured. A patch is available to address this issue.