CVE-2019-10869
HighCVSS 8.1Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
The Ninja Forms plugin for WordPress before version 3.0.23 (when the Uploads add-on is activated) contains path traversal and unrestricted file upload vulnerabilities. This allows an attacker to traverse the file system to access files and execute code via the name and tmp_name parameters in includes/fields/upload.php.
Risk Assessment
An attacker can access sensitive files on the server and execute malicious code, potentially leading to full site compromise.
Recommendation
Update the Ninja Forms plugin to version 3.0.23 or later.
Original NVD description (English source)
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.