CVE-2026-0740
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
Vexday Risk Score
75High priority
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 9.8EPSS 54.3%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
07 Apr 2026Published on NVD
07 Apr 2026Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SaturdayDrive · Ninja Forms - File Uploadspublic PoCs found — 3
githubgithub.com/whattheslime/CVE-2026-0740★ 1githubgithub.com/a24ac1/CVE-2026-0740★ 0exploitdbwww.exploit-db.com/exploits/52560unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →