As revealed in their post, they found a CSRF vulnerability in the plugin that appeared due to flaws in two functions. These functions failed to check nonces, thereby failing to verify whether an incoming request is from a legitimate user or not.
One of the affected functions includes ninja_forms_ajax_import_form that imports forms with HTML content.
To exploit the bug, an attacker merely had to send a maliciously crafted link to the site administrator. Clicking on this link would then import malicious JavaScript to the site using the admin’s session. Moreover, the attacker could also replace an existing form on the site with the malicious one.
According to the researchers, like every XSS, exploiting this flaw could allow lead to creating rogue admin accounts, takeover target sites, and redirect site visitors to malicious links.
The plugin’s website also reflects the fix in the changelog, where the developers have mentioned the fix with version 3.4.24.2. Since the patch is available, users must ensure updating their sites with the latest plugin version to avoid any exploitation.
Just before this one, the researchers also highlighted similar vulnerability in another WordPress plugin Real-Time Find and Replace. Exploiting that flaw could also allow creating rogue admin accounts and complete site takeovers.
Let us know your thoughts in the comments.
