CVE-2023-36505: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2023-36505) affects Saturday Drive's Ninja Forms Contact Form WordPress plugin versions through 3.6.24. This is an Improper Input Validation vulnerability that allows administrators to delete arbitrary files on the server even when they should not have such permissions (Patchstack, WPScan).

The vulnerability is classified as a path traversal issue (CWE-22) and is related to improper input validation (CWE-20). It received a CVSS v3.1 score of 6.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. The plugin does not properly validate the path of files to be deleted, which enables the arbitrary file deletion capability (Patchstack).

If exploited, this vulnerability could allow an authenticated administrator to delete arbitrary files from the server, including critical system files. This could potentially cause the website to break and stop functioning if core files are deleted (Patchstack).

The vulnerability requires administrator-level privileges to exploit, which somewhat limits its potential impact. It was discovered by security researcher Theodoros Malachias and was publicly disclosed on June 22, 2023 (WPScan).

The vulnerability has been fixed in version 3.6.25 of the Ninja Forms plugin. Users are advised to update to this version or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).