CVE-2021-4451

MEDIUM

NinjaFirewall < 4.3.3 - Authenticated PHAR Deserialization

Title source: llm

Description

The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall).

References (2)

Core 2

Core References

Patch

https://blog.nintechnet.com/security-issue-fixed-in-ninjafirewall-wp-edition/

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/1a1fc6c9-50cd-40fd-a777-9eed98aab797?source=cve

Scores

CVSS v3 6.6

EPSS 0.0062

EPSS Percentile 45.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-502

Status published

Products (2)

nintechnet/ninjafirewall < 4.3.3

nintechnet/NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall < 4.3.4

Published Oct 16, 2024

Tracked Since Feb 18, 2026