CVE-2021-34647: 
WordPress vulnerability analysis and mitigation

The Ninja Forms WordPress plugin (versions up to 3.5.7) contained a sensitive information disclosure vulnerability, identified as CVE-2021-34647. The vulnerability was discovered by Chloe Chamberland and publicly disclosed on September 22, 2021. This security issue affected over 1 million WordPress sites using the Ninja Forms plugin (Wordfence).

The vulnerability exists in the bulkexportsubmissions function located in the ~/includes/Routes/Submissions.php file. It allows authenticated attackers to access sensitive data through the /ninja-forms-submissions/export REST API endpoint. The vulnerability received a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue is classified as CWE-200: Sensitive Data Exposure (WPScan).

When exploited, this vulnerability allows authenticated attackers to export all Ninja Forms submissions data, which may contain personally identifiable information (PII) and other sensitive user data (WPScan).

The vulnerability was patched in Ninja Forms version 3.5.8. Site owners running affected versions should update to version 3.5.8 or later to protect against this security issue (WPScan).