CVE-2021-34647— Ninja Forms <= 3.5.7 Sensitive Information Disclosure
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-34647
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ninja Forms <= 3.5.7 Sensitive Information Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress 插件 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress 插件是WordPress开源的一个应用插件。 WordPress 插件 Ninja Forms 3.5.7及之前版本存在安全漏洞，经过身份验证的攻击者通过"/ninja-forms-submissions/export"的REST API导出所有Ninja Forms提交数据，其中可能包含个人身份信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Saturday Drive | Ninja Forms | 3.5.7 ~ 3.5.7 | - |
II. Public POCs for CVE-2021-34647
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-34647
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-34647 (1)
Vendor Advisories for CVE-2021-34647 (1)
IV. Related Vulnerabilities
Same product: Ninja Forms
- CVE-2026-15256
Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode - CVE-2026-65052
Ninja Forms Calculation and Payment Total Tampering via Fail - CVE-2026-65051
Ninja Forms Server-Side Validation Bypass via Client-Control - CVE-2026-65050
Ninja Forms Missing Authorization in submissions-table Guten - CVE-2026-65049
Ninja Forms Cross-Site Network-Wide Data Deletion on WordPre
Same vendor: Saturday Drive
- CVE-2026-65052
Ninja Forms Calculation and Payment Total Tampering via Fail - CVE-2026-65051
Ninja Forms Server-Side Validation Bypass via Client-Control - CVE-2026-65050
Ninja Forms Missing Authorization in submissions-table Guten - CVE-2026-65049
Ninja Forms Cross-Site Network-Wide Data Deletion on WordPre - CVE-2026-65048
Ninja Forms Unauthenticated Stored Cross-Site Scripting via
Same weakness: CWE-863
- CVE-2026-48508
Lemur: Authorization bypass in StrictRolePermission / Author - CVE-2026-45122
MyBB: Insufficient permission check for calendar event move - CVE-2026-45121
MyBB: Insufficient permission check for calendar select - CVE-2026-70657
Copyparty: file/dirkey confusion - CVE-2026-74906
SiYuan before v3.7.4 Incorrect Authorization via Publish Acc
V. Comments for CVE-2021-34647
No comments yet