CVE-2021-24163: 
WordPress vulnerability analysis and mitigation

CVE-2021-24163 is a critical vulnerability discovered in the Ninja Forms WordPress plugin versions below 3.4.34. The vulnerability was publicly disclosed on February 16, 2021, and involves an authenticated SendWP plugin installation and client secret key disclosure issue. This security flaw affected approximately one million WordPress sites (Wordfence Blog).

The vulnerability stems from an AJAX action 'wp_ajax_ninja_forms_sendwp_remote_install_handler' that lacked both capability checks and nonce protection. The vulnerability has been assigned a CVSS score of 9.9 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The issue is classified under CWE-200 (Sensitive Data Disclosure) and falls into the OWASP Top 10 category A3: Sensitive Data Exposure (WPScan).

The vulnerability allows low-level users, such as subscribers, to install and activate the SendWP plugin without proper authorization. Additionally, attackers could retrieve the client_secret key needed to establish the SendWP connection, potentially compromising the security of the affected WordPress installations (WPScan).

The vulnerability is exploitable by authenticated users with low-level privileges such as subscriber access. A proof of concept exists demonstrating how an attacker can leverage this vulnerability to install the SendWP plugin and obtain sensitive connection keys (WPScan).

The vulnerability has been patched in Ninja Forms version 3.4.34. Site administrators are strongly advised to update to this version or later to mitigate the risk. No alternative workarounds have been published (Wordfence Blog).