SUCURI, a leading WordPress security company, announced their finding of an SQL injection vulnerability in the popular Ninja Forms plugin.
The Ninja Forms plugin is installed on over 600,000 WordPress websites, and SUCURI is giving this a risk rating of Dangerous and should be updated to version 2.9.55.2 (or later) which fixes the vulnerability.
The exploit requires the attacker to have an account on the WordPress website. The privilege level doesn’t matter, meaning even a Subscriber could exploit this vulnerability. The attacker using this bug could acquire the site’s usernames and hashed passwords, the WordPress secret keys, and other data.
You can read more about the Ninja Form plugin exploit on the SUCURI blog.
At CurrentPhotographer.com we take security very seriously. With our Managed WordPress Hosting, we make sure that our client’s websites are backed up daily, and protected with multiple firewalls throughout our enterprise-grade infrastructure. Our real-time security threat detection, and security audits and code reviews help to keep client’s sites safe. Should a website become compromised, we will immediately take action to find the exploit, remove the malicious code, and have the site back up and running in no time.
*The Current Photographer website contains links to our affiliate partners. Purchasing products and services through these links helps support our efforts to bring you the quality information you love and there’s no additional cost to you.
Founder of Current Photographer, co-host of The Digital Photography Cafe Show, Designer, Photographer, and overall tech geek.