Ninja Forms WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Ninja Forms WordPress plugin, specifically in versions through 3.12.0. The issue arises from inadequate nonce validation in the 'maybe_opt_in' function, allowing unauthenticated attackers to manipulate usage statistics collection. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability allows for unauthorized modification of plugin settings, specifically opting a site into usage statistics collection without the administrator's consent.

Remediation

Users can update to Ninja Forms version 3.12.1 or a later patched version to address this vulnerability.