← back
CVE-2016-1209

CVE-2016-1209

EPSS 61.6%
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.htmlunverifiedexploitdbwww.exploit-db.com/exploits/41692unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000064http://jvn.jp/en/jp/JVN44657371/index.htmlhttp://packetstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.htmlhttps://ninjaforms.com/important-security-update-always-hurt-ones-love/https://wordpress.org/plugins/ninja-forms/changelog/https://wpvulndb.com/vulnerabilities/8485http://www.pritect.net/blog/ninja-forms-2-9-42-critical-security-vulnerabilitieshttp://www.rapid7.com/db/modules/exploit/unix/webapp/wp_ninja_forms_unauthenticated_file_upload