CVE-2020-12462: 
WordPress vulnerability analysis and mitigation

The ninja-forms plugin before version 3.4.24.2 for WordPress contained a Cross-Site Request Forgery (CSRF) vulnerability that could lead to Stored Cross-Site Scripting (XSS). The vulnerability was discovered on April 27, 2020, and was patched on April 28, 2020. This affected the Ninja Forms plugin, which has over 1 million installations and allows site admins to create WordPress forms (Wordfence Blog, SecurityWeek).

The vulnerability was assigned CVE-2020-12462 with a CVSS score of 8.8 (High). The issue stemmed from a feature that allowed users to revert the plugin's styling and features to version 2.9.x. Two functions added as part of this feature failed to check nonces, and one of them allowed importing forms containing custom HTML. This created a path for potential attackers to inject malicious JavaScript code through the import contact feature (WPScan).

If exploited, the vulnerability could allow attackers to replace any existing form on the site, execute code in visitors' browsers, redirect visitors to malicious websites, and potentially take over the site by creating rogue admin accounts. The attacker could achieve this by tricking an administrator into clicking a crafted link, which would allow them to spoof requests using the admin's session (SecurityWeek).

The vulnerability required an attacker to trick an administrator into clicking a specially crafted link. Once clicked, the attacker could exploit the CSRF vulnerability to import a form containing malicious JavaScript code, which would then be stored and executed when certain pages were visited (WPScan).

The vulnerability was patched in Ninja Forms version 3.4.24.2, released on April 28, 2020. Users were advised to update to this version immediately to protect their sites from potential attacks (Wordfence Blog).