Ninja Forms Contact Form Vulnerability – The Drag and Drop Form Builder for WordPress – Cross-Site Request Forgery to Publicly Accessible Form Submission Export – CVE-2024-2113 | WordPress Plugin Vulnerability Report

Plugin Name: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

Key Information:

  • Software Type: Plugin
  • Software Slug: ninja-forms
  • Software Status: Active
  • Software Author: kstover
  • Software Downloads: 43,897,090
  • Active Installs: 800,000
  • Last Updated: April 1, 2024
  • Patched Versions: 3.8.1
  • Affected Versions: <= 3.8.0

Vulnerability Details:

  • Name: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0
  • Title: Cross-Site Request Forgery to Publicly Accessible Form Submission Export
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
  • CVE: CVE-2024-2113
  • CVSS Score: 4.3
  • Publicly Published: March 28, 2024
  • Researcher: Tobias Weißhaar (kun_19)
  • Description: The Ninja Forms plugin, widely used for creating contact forms, is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 3.8.0. The vulnerability arises from inadequate nonce validation, allowing unauthenticated attackers to forge a request that triggers an export of form submissions to a publicly accessible location. This vulnerability requires the attacker to deceive an administrator into clicking a malicious link to execute the exploit.


The Ninja Forms Contact Form plugin, an essential tool for countless WordPress sites, has been found to contain a Cross-Site Request Forgery vulnerability in versions up to and including 3.8.0. This security flaw, which could lead to unauthorized data exposure, has been effectively patched in version 3.8.1.

Detailed Overview:

Discovered by security researcher Tobias Weißhaar, this CSRF vulnerability highlights a critical oversight in nonce validation within the plugin's AJAX actions. By exploiting this flaw, attackers could potentially export sensitive form submission data without proper authentication, provided they can manipulate an administrator into interacting with a malicious link. The swift release of a patched version (3.8.1) by the plugin developers mitigates this risk, protecting sites from potential data breaches.

Advice for Users:

  • Immediate Action: Users of the Ninja Forms plugin are strongly advised to update to the patched version 3.8.1 immediately to safeguard their websites from potential exploitation.
  • Check for Signs of Vulnerability: Site administrators should review their site's access logs and exported files for any unusual activity that may indicate the exploitation of this vulnerability.
  • Alternate Plugins: While the vulnerability has been addressed, users may explore alternative form builder plugins as a precautionary measure, especially if they have ongoing concerns about security.
  • Stay Updated: Maintaining the latest versions of all WordPress plugins is essential for site security. Users should regularly check for and apply updates to defend against known vulnerabilities.


The prompt response by the developers of Ninja Forms to patch the CSRF vulnerability underscores the critical importance of maintaining up-to-date software on all WordPress sites. Users are urged to ensure their Ninja Forms plugin is updated to version 3.8.1 or later, reinforcing their site's defenses against this and other potential security threats.


Detailed Report: 

In the digital age, where websites are increasingly powered by versatile plugins like Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress, the importance of cybersecurity cannot be overstated. The discovery of the Cross-Site Request Forgery (CSRF) vulnerability, designated as CVE-2024-2113, in such a widely used plugin is a stark reminder of the potential risks lurking within even the most trusted tools. This vulnerability not only highlights the need for constant vigilance but also underscores the critical role of timely software updates in safeguarding digital assets.

About Ninja Forms:

Ninja Forms, a plugin developed by kstover, has revolutionized the way WordPress users create and manage forms, boasting an impressive 43,897,090 downloads and 800,000 active installations. Its ease of use and drag-and-drop functionality have made it an essential component for many WordPress sites, allowing for seamless interaction with site visitors.

The Vulnerability Unveiled:

CVE-2024-2113 exposes a significant flaw in versions up to and including 3.8.0 of Ninja Forms, where insufficient nonce validation could allow unauthenticated attackers to export form submissions to publicly accessible locations through forged requests. Identified by Tobias Weißhaar, this vulnerability could potentially lead to unauthorized data exposure, putting sensitive information at risk.

Risks and Potential Impacts:

The implications of such a vulnerability are far-reaching, with the potential for compromising not only the confidentiality and integrity of the data collected through the forms but also the trust and reliability of the website in the eyes of its users. In a digital landscape where data breaches can have devastating consequences, understanding and mitigating such vulnerabilities is paramount.

Remediation Steps:

In response to the discovery of CVE-2024-2113, the developers of Ninja Forms have released a patched version, 3.8.1, effectively addressing the vulnerability. Users are urged to update their installations immediately to this latest version to prevent potential exploitation. Additionally, regularly monitoring site activity and being cautious of unsolicited links can further bolster a site's defense against such threats.

A Look at the Past:

With 51 vulnerabilities reported since November 2014, the security history of Ninja Forms reflects the broader challenge of maintaining plugin security within the WordPress ecosystem. Each reported vulnerability serves as a learning opportunity, not only for the developers but also for the users, in understanding the evolving nature of cyber threats.

The Imperative of Digital Vigilance:

For small business owners managing WordPress sites, the incident serves as a compelling reminder of the importance of staying abreast of security updates and vulnerabilities. In a realm where digital threats are constantly evolving, the security of a website is predicated on the timely application of updates and a proactive approach to cybersecurity. Balancing the myriad responsibilities of business management with the demands of website maintenance can be challenging, yet the consequences of neglecting such duties can be far more burdensome. Thus, embracing a routine of regular maintenance and vigilance is not just advisable; it is indispensable in securing the digital frontiers of today's businesses.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Ninja Forms Contact Form Vulnerability – The Drag and Drop Form Builder for WordPress – Cross-Site Request Forgery to Publicly Accessible Form Submission Export – CVE-2024-2113 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment