By 
WordPress websites using a widely used plugin named Ninja Forms was updated automatically to rectify a critical security vulnerability which is believed to have been actively exploited in the wild.
The issue, which relates to a case of code injection, is given the severity rating of 9.8 out of 10 and affects multiple versions starting from 3.0. It has been fixed in 3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, and 3.6.11.
Ninja Forms plugin is a customizable contact form builder having more than 1 million installations.
Wordfence threat analyst Ramuel Gall discovered that by exploiting the bug, it is possible for unauthenticated attackers to call a limited number of methods in various Ninja Forms classes, including a method that unserialized user-supplied content, resulting in Object Injection.
This could allow attackers to execute arbitrary code or delete arbitrary files on sites where a separate chain was present.
On successful exploitation of the flaw, an attacker can achieve remote code execution and completely take over a vulnerable WordPress site.
While there has not been an official announcement, most vulnerable websites seem to have already been force-updated based on the number of downloads since this flaw was patched on June 14.
According to Ninja Forms' downloads stats, the security update has been rolled out over 730,000 times since the patch was released.
All the users of Ninja Forms are recommended to ensure that their WordPress sites are updated to run the latest patched version to prevent any possible exploitation attempts in the wild.
