Missing Authorization in Ninja Forms Save Progress WordPress Plugin

Executive Summary

This vulnerability is in the Ninja Forms - Save Progress WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to delete database records from the wp_nf3_objects table due to missing capability checks and nonce verification in the bulk_actions function.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Ninja Forms - Save Progress plugin is installed and its version is up to and including 3.0.30. Inspect WordPress logs for unauthorized database record deletions or bulk actions performed by low-privilege users. Review server logs for suspicious activity targeting the 'wp_nf3_objects' table.

Useful 0 Not Useful 0

Impact Analysis

An attacker could delete saved form submissions or other data stored in the wp_nf3_objects table. This could lead to loss of user data, form submissions, or other critical information managed by the plugin.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Ninja Forms - Save Progress plugin to the latest version to patch the missing authorization flaw. Ensure all users follow the principle of least privilege, restricting subscriber-level access to only necessary functions. Monitor the 'wp_nf3_objects' table for unauthorized deletions.

Useful 0 Not Useful 0