CyberRota Analysis
AI-GeneratedThe Ninja Forms - Excel Export plugin for WordPress is susceptible to a Directory Traversal vulnerability that allows authenticated users with subscriber-level access or higher to write .xls/.xlsx files to arbitrary server locations. This could enable attackers to stage further attacks by manipulating file storage on the server. WordPress site administrators using this plugin should prioritize patching to mitigate potential exploitation risks.
Original NVD Description
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.