730K WordPress Sites Force-Updated To Patch Critical Plugin Bug

WordPress sites using Ninja Forms, a forms builder plugin with more than 1 million installations, have been force-updated this week to a new build that addresses a critical security vulnerability. The vulnerability is a code injection vulnerability affecting multiple Ninja Forms releases, starting with version 3.0 and up.

This could allow attackers to execute arbitrary code or delete arbitrary files on sites where a separate POP chain was present.

About this vulnerability:

This vulnerability is being actively exploited in the wild .

Ninja Forms is a popular WordPress plugin designed to enhance WordPress sites with easily customizable forms.

This flaw has been fully patched in versions 3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, and 3.6.11.

WordPress appears to have performed a forced automatic update for this plugin, so that site may already be using one of the patched version. Nonetheless, Researchers strongly recommend to update one of the patched version.

According to Ninja Forms’ downloads stats,

The security update has been rolled out over 730,000 times since the patch was released.