Description
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter.
References (3)
Core 3
Core References
Product, Third Party Advisory x_refsource_misc
https://wordpress.org/plugins/ninja-forms/#developers
Exploit, Third Party Advisory x_refsource_misc
https://plugins.trac.wordpress.org/changeset/1982808/ninja-forms/trunk/lib/StepProcessing/step-processing.php
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/9154
Scores
CVSS v3
6.1
EPSS
0.0158
EPSS Percentile
72.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-601
Status
published
Products (1)
ninjaforms/ninja_forms
< 3.3.19.1
Published
Dec 03, 2018
Tracked Since
Feb 18, 2026