CVE Intelligence
Analysis AI-assisted

CVE-2026-0740: Ninja Forms File Uploads: unrestricted file upload

The Ninja Forms - File Uploads plugin for WordPress lacks file type validation, which lets unauthenticated attackers upload arbitrary files. Wordfence rates the issue critical with a CVSS 3.1 score of 9.8. According to the record, versions up to and including 3.3.26 are affected and 3.3.27 is the full fix.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Ninja Forms - File Uploads extension for WordPress does not validate file types in its upload handler, as described in the NVD record and the Wordfence entry. The weakness is classified as CWE-434, unrestricted upload of file with dangerous type.

Impact

  • Unauthenticated attackers may upload arbitrary files to the affected server.
  • The record states that this may make remote code execution possible.
  • Wordfence scores the issue 9.8 (critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high confidentiality, integrity and availability impact.

Affected products and versions

  • Product: Ninja Forms - File Uploads plugin for WordPress.
  • Affected: all versions up to and including 3.3.26, according to the description.
  • The structured affected and fixes lists in the record are empty, so the version information comes from the description text.
  • The description states the issue was partially patched in 3.3.25 and fully patched in 3.3.27.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted. The EPSS score is an estimated probability and is not evidence of exploitation.

Remediation and mitigation

  • Update the plugin to version 3.3.27, which the description identifies as the full fix.
  • Do not treat 3.3.25 as remediated, since the description says it was only partially patched, and 3.3.26 is within the affected range.
  • Review the Ninja Forms File Uploads page for vendor information.
  • Until the update is applied, limit access to upload functionality where operationally possible and review upload directories for unexpected files.

Detection guidance

  • Review web server and WordPress logs for unexpected upload requests to Ninja Forms upload endpoints, especially from unauthenticated sessions.
  • Look for recently created files with executable or script extensions in upload and plugin directories.
  • Compare installed plugin files against expected contents to spot unauthorized additions.

Limitations of the available information

  • The record has empty structured affected and fixes fields, so version boundaries rely on the description.
  • The vendor page was not verified for patch details or release notes in this analysis.
  • The record cannot show whether any specific site has been compromised.

Frequently asked questions

Which versions of Ninja Forms File Uploads are affected by CVE-2026-0740?

According to the record's description, all versions up to and including 3.3.26 are affected. The record's structured affected list is empty, so this comes from the description text.

Which version should I update to?

The description states that the issue was fully patched in version 3.3.27. It also says 3.3.25 was only partially patched.

Is this vulnerability known to be actively exploited?

This CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.