CVE-2024-13940

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Ninja Forms	Ninja Forms Webhooks	<= 3.0.7

References

Timeline

Published: May 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-139415.3A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::co CVE-2024-139427.6Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND CVE-2024-139437.8Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability. This vulnerability allows local att CVE-2024-139447.8Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Window CVE-2024-139456.0Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This CVE-2024-139466.8DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commi CVE-2024-139476.0Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue a CVE-2024-139487.3Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affect CVE-2024-139496.8Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials becom CVE-2024-13956.7Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU m CVE-2024-139506.8Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become comp CVE-2024-139517.6One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPE