CVE-2019-10869 - CVE House
Back to Database
Status published High CVE-2019-10869

Path Traversal and Unrestricted File Upload exists in the Ninja...

Vulnerability Description

Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10869

Credits & Attribution

No credits recorded in the NVD database.

References

More from ninjaforms

View All →
CVE-2020-8594
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored...
Medium 5.4
CVE-2020-36175
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers...
Medium 5.3
CVE-2020-36174
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF...
Medium 6.5
CVE-2020-36173
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping...
Medium 5.3
CVE-2020-12462
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with...
Medium 6.1

Affected Vendor

Affected Software

ninja forms file uploads
Vulnerable Versions:
0

Timeline

Official Publish: May 7th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.