CVE-2024-2113: 
WordPress vulnerability analysis and mitigation

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 3.8.0, identified as CVE-2024-2113. The vulnerability stems from missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This vulnerability was discovered and publicly disclosed on March 29, 2024, with a CVSS v3.1 base score of 4.3 (Medium) (NVD).

The vulnerability exists due to improper nonce validation in the nf_download_all_subs AJAX action. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required. The vulnerability affects the plugin's form submission export functionality (Wordfence Advisory).

If exploited, this vulnerability allows unauthenticated attackers to trigger an export of a form's submission data to a publicly accessible location. This can occur when an attacker successfully tricks a site administrator into performing specific actions, such as clicking on a malicious link (NVD).

The vulnerability requires user interaction to be exploited, specifically requiring a site administrator to be tricked into performing certain actions. The attack can be initiated remotely without requiring privileges, though successful exploitation depends on social engineering tactics (Wordfence Advisory).

A patch has been released to address this vulnerability. Users should upgrade their Ninja Forms plugin to a version newer than 3.8.0. The fix includes proper nonce validation implementation for the affected AJAX action (WordPress Patch).