CVE-2024-2113

CVE-2024-2113 is a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 3.8.0 of the Ninja Forms Contact Form plugin for WordPress. This flaw stems from missing or incorrect nonce validation on the nf_download_all_subs AJAX action. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to the export of form submissions to a publicly accessible location. Rated 4.3 MEDIUM on the CVSS scale, this vulnerability has low complexity but requires user interaction and has a low impact on confidentiality. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.