CVE-2026-126537 · Package
NO FIX YET · SEE WHAT TO DO
The Ninja Forms File Uploads add-on for WordPress lets anonymous visitors submit a file path that the server later deletes or reads, bypassing its own upload-directory check. Deleting wp-config.php can force WordPress into its setup screen, enabling full site takeover.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Ninja Forms - File Uploads add-on up to and including 3.3.36 that accept public form submissions with file uploads. The flaw is reached by a public submission that omits upload_id, so sites without public upload forms are less exposed. The sources do not say whether managed WordPress hosting changes exposure.
Not affected if add-on-not-installed, no-public-file-upload-forms
Who cares ninja-forms, self-hosted, wordpress
wp plugin list against the fixed version.3.3.36 (fixed version not stated in the sources).The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php — which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress — and NF_FU_External_Abstracts_Service::process_upload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends upload_id. By omitting upload_id, an attacker's data[file_path] survives into the Background Upload queue and is used by both upload_file_to_s3() (as SourceFile) and the maybe_delete_server_file() unlink() call in includes/external/abstracts/backgroundupload.php, with no canonicalization or upload-directory containment check (the plugin's own is_path_within_upload_dir() helper is only applied on admin paths). This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible — specifically, deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.