vulnerability
WordPress Plugin: ninja-forms: CVE-2023-36505: External Control of File Name or Path
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 6 | (AV:N/AC:L/Au:N/C:N/I:P/A:P) | Jun 22, 2023 | May 15, 2025 | Jul 9, 2025 |
Severity
6
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:P)
Published
Jun 22, 2023
Added
May 15, 2025
Modified
Jul 9, 2025
Description
The Ninja Forms plugin for WordPress is vulnerable to arbitrary file deletions in versions up to, and including, 3.6.24. This is due to insufficient restriction on the file path that can be supplied during file deletion. This makes it possible for authenticated attackers, with administrative-level access, to delete arbitrary files on the server. One such file that could be targeted is wp-config.php which if deleted can make it possible for an attacker to connect a site to their own database and ultimately achieve remote code execution on the server.
Solution
ninja-forms-plugin-cve-2023-36505
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.