CVE-2016-1209: ninjaforms ninja_forms
Vulnerability summary
CVE-2016-1209 is a critical (CVSS 9.8) vulnerability in ninjaforms ninja_forms. EPSS estimates a 61.61% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 4 public exploits are recorded.
Timeline
- 14-05-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
61.61%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 61.61% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (rapid7.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
WordPress Plugin Ninja Forms 2.9.36 < 2.9.42 - File Upload (Metasploit)
Maturity: poc
Weaknesses
CWE · root cause- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Ninjaforms1 product
- ninja_forms≤ 2.9.42
Wordpress1 product
- ninja-forms≥ 2.9.36, ≤ 2.9.42 (fixed in 2.9.42.1)
2 vendors · 2 products
References
10 links- wordpress.org/plugins/ninja-forms/changelog/X Refsource CONFIRM
- wpvulndb.com/vulnerabilities/8485X Refsource MISC
- ninjaforms.com/important-security-update-always-hurt-ones-love/X Refsource CONFIRM
- www.rapid7.com/db/modules/exploit/unix/webapp/wp_ninja_forms_unauthenticated_file_uploadX Refsource MISCExploit
- packetstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.htmlX Refsource MISCExploit