CVE-2024-0685 is a medium severity second order SQL injection in the Ninja Forms plugin for WordPress, scored 5.9, in all versions up to and including 3.7.1. It fires when an administrator runs a personal data export. Update Ninja Forms and check the vendor changelog for the fixed release.
What's affected
The record says the Ninja Forms Contact Form plugin for WordPress is affected in all versions up to and including 3.7.1. I could not retrieve the vendor changeset or advisory pages, so a fixed version is not confirmed here. The record says all versions up to and including 3.7.1 are affected, which implies a later release carries the fix. Check the plugin changelog on WordPress.org and the Wordfence entry before you rely on a specific number.
The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The attack complexity is high, no privileges are needed, and the impact is a high loss of confidentiality only. The record's reference list includes a trac changeset to the plugin's UserDataRequests.php file, where the change was made. The weakness class is CWE-89.
How to check if you're exposed
If you have WP-CLI access, list installed plugins and their versions:
wp plugin list --fields=name,version,status,update
Look for the ninja-forms row. If the version is 3.7.1 or lower, you are in the affected range. You can also open Plugins in the WordPress admin and read the version under the plugin name.
To update from the command line:
wp plugin update ninja-forms
Deactivated plugins still sit on disk and in some cases can still be reached by URL, so check inactive ones too.
What to do now
- Check the installed version of the plugin on every WordPress site you run, including staging copies.
- Update to the latest release and confirm in the changelog that the issue is addressed.
- If you cannot update right away, deactivate the plugin until you can, or restrict access with your web application firewall.
- Review access logs and the database for unexpected activity if the site was exposed for a long period.
- Add the plugin to the list you watch for new advisories.
Why it matters
This is a second order injection. An attacker submits a crafted value in the email address field of a form. The value is stored safely at first. It becomes dangerous later, when an administrator triggers a personal data export and the plugin builds a database query using the stored email without sufficient escaping or preparation.
Second order bugs are easy to miss in review because the input and the vulnerable query sit in different code paths and run at different times. The defence is the same as for any SQL injection: use prepared statements with bound parameters everywhere, including for data that came out of your own database. The scored impact is data disclosure, so treat the export function as a place where sensitive records could be read.
The record does not mark this CVE as known exploited, and no advisory I fetched says it is. Plugin flaws like this are still scanned for in bulk once they are public, so patch windows matter more than the exact score.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is the complexity rated high?
The injected value only matters when an administrator later runs a personal data export, so an attacker depends on that step happening.
Does this give code execution?
The record scores impact as confidentiality only. It describes appending SQL to an existing query.
Sources
- Wordfence entry for CVE-2024-0685
- Plugin changeset 3028929
- Researcher write-up referenced by the record
Last reviewed: 19 October 2026.
