CVE-2026-0740

This issue means the plugin’s “upload” feature doesn’t properly restrict what file types can be uploaded and who is allowed to upload. Imagine a store that lets anyone walk up to the back door and drop off packages—those packages might include dangerous items that let an attacker get inside and control the system.

In the worst case, uploaded files can be crafted to let attackers run commands on your server.

This matters if you run WordPress and use the Ninja Forms - File Uploads plugin, especially if your version is 3.3.26 or older. Because the upload is unauthenticated, attackers do not need a username or password.

The risk applies when an attacker can reach the plugin’s upload functionality from the internet (the vulnerable upload handler is exposed publicly as part of the site).

This is RED because the vulnerability is critical and can allow attackers to upload files without logging in, which can quickly escalate to full site compromise. Our traffic signals show rising incident-related attention, and the likelihood of exploitation is high.

Act now by upgrading immediately; delaying increases the chance attackers try it against exposed sites.

1. Confirm exposure

   • Log into WordPress (admin).
   • Go to the Plugins page and locate “Ninja Forms - File Uploads”.
   • Record the installed version.
   • This issue applies if the plugin version is 3.3.26 or earlier.

2. Upgrade to the fixed version

   • Upgrade Ninja Forms - File Uploads to version 3.3.27 (or later).
   • If you manage WordPress via staging, test the upgrade on staging first, then promote to production.

3. Validate after upgrading

   • Re-check the plugin version is now 3.3.27+.
   • Attempt normal uploads through the intended form workflow to ensure the feature still works.

4. If you can’t upgrade immediately (temporary containment)

   • Disable the “File Uploads” capability by disabling the plugin or turning off the specific upload feature while you prepare the upgrade.
   • Add web application firewall (WAF) / reverse-proxy rules to block access to the vulnerable upload handler from the public internet until patched.

5. Look for signs of compromise

   • Check web server logs for suspicious POST/upload requests around the time of any incident.
   • Review the WordPress media/uploads directories for unexpected files (especially unusually named files, odd extensions, or recent timestamps).
   • If you find suspicious files, remove them and consider a broader incident response (including rotating credentials).

6. What to monitor going forward

   • Continued upload attempts that fail after patching.
   • Unexpected new files/directories under WordPress content paths.
   • WordPress admin logins and form submissions from unusual IPs or geographies.

Severity is critical (CVSS 9.8) for Ninja Forms - File Uploads because it enables remote, unauthenticated upload of arbitrary files (CWE-434) to the server. The mechanism is a missing or insufficient file type validation in NF_FU_AJAX_Controllers_Uploads::handle_upload in all versions up to and including 3.3.26.

Exploit status: no public exploit code was found on record, but the issue has rising incident-related attention. The traffic-light verdict is RED.

Patch status: partially addressed in 3.3.25 and fully patched in 3.3.27.

KEV status: not listed in CISA KEV at the time of these findings.

Exploit maturity: at least “in the wild attempts” are plausible given the reported incident attention; no confirmed public PoC/exploit code was recorded.