Nasty WordPress plugin vulnerabilities puts over a million sites at risk

Two vulnerabilities in the popular Ninja Forms WordPress plugin could’ve enabled threat actors to export sensitive information and send phishing emails from a vulnerable site, report security researchers.

In their breakdown of the vulnerability, cybersecurity researchers from Wordfence, which develops security solutions to protect WordPress installations, note that Ninja Forms boasts of an installation base of over one million websites.

The researchers explain that the vulnerabilities existed because the popular form building plugin relied on an insecure implementation of the mechanism that checks a user’s permissions.

The insecure implementation meant that instead of ensuring a logged-in user had the right permissions to trigger the associated action, the function only checked if the user was in fact logged-in or not, and nothing else.