A critical vulnerability has been discovered in the WordPress plugin Ninja Forms, which has more than a million active installations (CVE not yet assigned), allowing an unauthorized visitor to gain full control over the site. The issue has been resolved in releases 3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, and 3.6.11. It is noted that the vulnerability is already being exploited to carry out attacks, and to urgently address the issue, the developers of the WordPress platform have initiated a mandatory automatic update installation on users' sites.
The vulnerability is caused by an error in the implementation of the Merge Tags feature, allowing unauthorized users to invoke certain static methods from various Ninja Forms classes (the function is_callable() was called to check for method references in the data passed through Merge Tags). Specifically, access was available to a method that deserializes content provided by the user. By sending specially crafted serialized data, the attacker could substitute their objects and achieve the execution of PHP code on server or delete arbitrary files in the site data directory.
Source: opennet.ru
