{"id":"CVE-2026-126537","kind":"vulnerability","aliases":["CVE-2026-126537"],"related":[],"title":"Ninja Forms File Uploads WordPress add-on: unauthenticated arbitrary file deletion and read","description":"The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php — which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress — and NF_FU_External_Abstracts_Service::process_upload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends upload_id. By omitting upload_id, an attacker's data[file_path] survives into the Background Upload queue and is used by both upload_file_to_s3() (as SourceFile) and the maybe_delete_server_file() unlink() call in includes/external/abstracts/backgroundupload.php, with no canonicalization or upload-directory containment check (the plugin's own is_path_within_upload_dir() helper is only applied on admin paths). This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible — specifically, deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover.","summary":"The Ninja Forms File Uploads add-on for WordPress lets anonymous visitors submit a file path that the server later deletes or reads, bypassing its own upload-directory check. Deleting wp-config.php can force WordPress into its setup screen, enabling full site takeover.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ninja-forms","package","self-hosted","wordpress"],"not_affected_if":["add-on-not-installed","no-public-file-upload-forms"],"how_to_check":"- Check the installed version of the Ninja Forms - File Uploads add-on in the WordPress plugins screen or `wp plugin list` against the fixed version.\n- Confirm whether the add-on's upload features (S3, Dropbox or Google Drive) are enabled on public forms.","fix":"- Ninja Forms - File Uploads add-on: move to a version later than `3.3.36` (fixed version not stated in the sources).","status":"open","published_at":"2026-11-11T13:17:23+00:00","first_seen_at":"2026-11-11T13:27:15+00:00","triaged_at":"2026-11-11T13:29:08+00:00","updated_at":"2026-11-11T13:29:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T13:29:08Z","model":"claude-haiku-5-5","output":{"fix":"- Ninja Forms - File Uploads add-on: move to a version later than `3.3.36` (fixed version not stated in the sources).","reach":"internet","title":"Ninja Forms File Uploads WordPress add-on: unauthenticated arbitrary file deletion and read","impact":"high","summary":"The Ninja Forms File Uploads add-on for WordPress lets anonymous visitors submit a file path that the server later deletes or reads, bypassing its own upload-directory check. Deleting wp-config.php can force WordPress into its setup screen, enabling full site takeover.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ninja-forms","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Anonymous attacker deletes wp-config.php, taking over the site","analyst_note":"Confirm the fixed version of the Ninja Forms - File Uploads add-on beyond 3.3.36 and whether the vendor published a patch.","how_to_check":"- Check the installed version of the Ninja Forms - File Uploads add-on in the WordPress plugins screen or `wp plugin list` against the fixed version.\n- Confirm whether the add-on's upload features (S3, Dropbox or Google Drive) are enabled on public forms.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-public-file-upload-forms","add-on-not-installed"],"who_is_affected":"Sites running the Ninja Forms - File Uploads add-on up to and including 3.3.36 that accept public form submissions with file uploads. The flaw is reached by a public submission that omits upload_id, so sites without public upload forms are less exposed. The sources do not say whether managed WordPress hosting changes exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00083,"input_tokens":4906,"output_tokens":678,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126537':17A,20A '-2026':16A,19A '3.3.36':103C 'abstract':136C 'add':7A,35B,79C 'add-on':6A,34B,78C 'admin':215C 'affect':230C 'anonym':40B 'appli':213C 'arbitrari':10A,86C,90C,226C 'attack':160C,223C 'authorit':144C 'authoritative-path':143C 'background':168C 'bypass':53B 'call':189C 'canonic':194C 'carri':128C 'check':59B,200C 'client':120C,151C 'client-suppli':119C 'code':238C 'contain':199C 'cve':15A,18A 'data':162C 'delet':12A,50B,60B,88C,185C,225C,242C 'dir':209C 'directori':58B,198C 'drive':95C 'earli':116C 'enabl':69B,250C 'execut':239C 'exfiltr':96C 'extern':135C 'extra.saveprogress':131C 'field':109C 'file':3A,11A,32B,44B,76C,87C,91C,122C,163C,177C,187C,227C 'fire':148C 'flaw':105C 'forc':63B,244C 'form':2A,23B,31B,75C 'fu':108C,134C 'full':70B,251C 'helper':210C 'host':27B 'id':154C,158C 'includ':102C 'includes/external/abstracts/backgroundupload.php':191C 'includes/external/abstracts/service.php':141C 'includes/fields/upload.php':113C 'intact':123C 'later':49B 'leav':117C 'let':39B 'make':218C,236C 'may':235C 'mayb':184C 'nf':107C,133C 'ninja':1A,22B,30B,74C 'ninja-form':21B 'nonempti':130C 'omit':156C 'packag':24B 'path':45B,145C,164C,206C,216C 'plugin':202C 'possibl':220C,240C 'process':111C,138C 'public':126C 'queue':170C 'read':14A,52B,92C 'reload':146C 'remot':237C 'return':115C 's3':179C 's3/dropbox/google':94C 'screen':68B,249C 'self':26B 'self-host':25B 'send':152C 'server':48B,186C,233C 'servic':137C 'setup':67B,248C 'site':71B,231C,252C 'sourcefil':181C 'span':106C 'specif':241C 'submiss':127C 'submit':42B 'suppli':121C 'surviv':165C 'takeov':72B,253C 'unauthent':9A,222C 'unlink':188C 'upload':4A,33B,57B,77C,110C,139C,153C,157C,169C,176C,197C,208C 'upload-directori':56B,196C 'use':173C 'version':98C 'via':93C 'visitor':41B 'vulner':84C 'whenev':124C 'whose':142C 'within':207C 'wordpress':5A,28B,38B,64B,82C,245C 'wp-config.php':61B,243C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ninja Forms - File Uploads add-on up to and including 3.3.36 that accept public form submissions with file uploads. The flaw is reached by a public submission that omits upload_id, so sites without public upload forms are less exposed. The sources do not say whether managed WordPress hosting changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","ninjaforms","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-126537':17A,20A '-2026':16A,19A 'add':7A 'add-on':6A 'arbitrari':10A 'cve':15A,18A 'delet':12A 'file':3A,11A 'form':2A 'ninja':1A 'read':14A 'unauthent':9A 'upload':4A 'wordpress':5A","search_b":"'add':35B 'add-on':34B 'anonym':40B 'bypass':53B 'check':59B 'delet':50B,60B 'directori':58B 'enabl':69B 'file':32B,44B 'forc':63B 'form':23B,31B 'full':70B 'host':27B 'later':49B 'let':39B 'ninja':22B,30B 'ninja-form':21B 'packag':24B 'path':45B 'read':52B 'screen':68B 'self':26B 'self-host':25B 'server':48B 'setup':67B 'site':71B 'submit':42B 'takeov':72B 'upload':33B,57B 'upload-directori':56B 'visitor':41B 'wordpress':28B,38B,64B 'wp-config.php':61B","search_c":"'3.3.36':103C 'abstract':136C 'add':79C 'add-on':78C 'admin':215C 'affect':230C 'appli':213C 'arbitrari':86C,90C,226C 'attack':160C,223C 'authorit':144C 'authoritative-path':143C 'background':168C 'call':189C 'canonic':194C 'carri':128C 'check':200C 'client':120C,151C 'client-suppli':119C 'code':238C 'contain':199C 'data':162C 'delet':88C,185C,225C,242C 'dir':209C 'directori':198C 'drive':95C 'earli':116C 'enabl':250C 'execut':239C 'exfiltr':96C 'extern':135C 'extra.saveprogress':131C 'field':109C 'file':76C,87C,91C,122C,163C,177C,187C,227C 'fire':148C 'flaw':105C 'forc':244C 'form':75C 'fu':108C,134C 'full':251C 'helper':210C 'id':154C,158C 'includ':102C 'includes/external/abstracts/backgroundupload.php':191C 'includes/external/abstracts/service.php':141C 'includes/fields/upload.php':113C 'intact':123C 'leav':117C 'make':218C,236C 'may':235C 'mayb':184C 'nf':107C,133C 'ninja':74C 'nonempti':130C 'omit':156C 'path':145C,164C,206C,216C 'plugin':202C 'possibl':220C,240C 'process':111C,138C 'public':126C 'queue':170C 'read':92C 'reload':146C 'remot':237C 'return':115C 's3':179C 's3/dropbox/google':94C 'screen':249C 'send':152C 'server':186C,233C 'servic':137C 'setup':248C 'site':231C,252C 'sourcefil':181C 'span':106C 'specif':241C 'submiss':127C 'suppli':121C 'surviv':165C 'takeov':253C 'unauthent':222C 'unlink':188C 'upload':77C,110C,139C,153C,157C,169C,176C,197C,208C 'upload-directori':196C 'use':173C 'version':98C 'via':93C 'vulner':84C 'whenev':124C 'whose':142C 'within':207C 'wordpress':82C,245C 'wp-config.php':243C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126537","severity":null,"published_at":"2026-11-11T13:17:23+00:00","modified_at":"2026-11-11T13:17:23+00:00","first_seen_at":"2026-11-11T13:27:15+00:00","fetched_at":"2026-11-11T13:27:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}