Threats tagged 'ghsa-f833-cw2q-6hm3'

The Ninja Forms plugin for WordPress versions before 3.15.4 has a server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to certain list and location fields. This occurs because the validation method only checks for required fields and does not properly validate input for Checkbox List, Multi-Select List, Image List, Country, and State fields. Attackers can exploit this by submitting crafted payloads through the unauthenticated nf_ajax_submit endpoint, bypassing CSV escaping protections for these fields. This leads to CSV injection when an administrator exports and opens the submissions file.