Broken Access Control in Ninja Forms Telemetry REST Endpoint

The telemetry REST route’s permission callback only required a logged-in user, so any authenticated user including a subscriber could write arbitrary data into the wp_options table. The route now requires the manage_options capability and validates and sanitises the submitted payload.

This vulnerability affects the following application versions:

• Ninja Forms – The Contact Form Builder 3.8.19
• Ninja Forms – The Contact Form Builder 3.8.20
• Ninja Forms – The Contact Form Builder 3.8.21
• Ninja Forms – The Contact Form Builder 3.8.22
• Ninja Forms – The Contact Form Builder 3.8.23
• Ninja Forms – The Contact Form Builder 3.8.24
• Ninja Forms – The Contact Form Builder 3.8.25
• Ninja Forms – The Contact Form Builder 3.8.25.1
• Ninja Forms – The Contact Form Builder 3.9.0
• Ninja Forms – The Contact Form Builder 3.9.1
• Ninja Forms – The Contact Form Builder 3.9.2
• Ninja Forms – The Contact Form Builder 3.9.2.1
• Ninja Forms – The Contact Form Builder 3.10.0
• Ninja Forms – The Contact Form Builder 3.10.1
• Ninja Forms – The Contact Form Builder 3.10.2
• Ninja Forms – The Contact Form Builder 3.10.2.1
• Ninja Forms – The Contact Form Builder 3.10.2.2
• Ninja Forms – The Contact Form Builder 3.10.3
• Ninja Forms – The Contact Form Builder 3.10.4
• Ninja Forms – The Contact Form Builder 3.10.4.1
• Ninja Forms – The Contact Form Builder 3.11.0
• Ninja Forms – The Contact Form Builder 3.11.1
• Ninja Forms – The Contact Form Builder 3.11.1.1
• Ninja Forms – The Contact Form Builder 3.12.0
• Ninja Forms – The Contact Form Builder 3.12.1
• Ninja Forms – The Contact Form Builder 3.12.2
• Ninja Forms – The Contact Form Builder 3.12.2.1
• Ninja Forms – The Contact Form Builder 3.13.0
• Ninja Forms – The Contact Form Builder 3.13.1
• Ninja Forms – The Contact Form Builder 3.13.2
• Ninja Forms – The Contact Form Builder 3.13.3
• Ninja Forms – The Contact Form Builder 3.13.4
• Ninja Forms – The Contact Form Builder 3.14.0
• Ninja Forms – The Contact Form Builder 3.14.1
• Ninja Forms – The Contact Form Builder 3.14.2
• Ninja Forms – The Contact Form Builder 3.14.3
• Ninja Forms – The Contact Form Builder 3.14.4