Ninja Forms File Uploads: Unauthenticated arbitrary file deletion
Summary
The File Uploads add-on for Ninja Forms on WordPress lets unauthenticated users delete arbitrary files on the server. A client-supplied file path is not validated when a public form submission sets extra.saveProgress and omits upload_id. Deleting wp-config.php makes WordPress show its setup screen, which can enable full site takeover. The record also describes arbitrary file read through S3, Dropbox and Google Drive exfiltration. Exposure exists only on sites that run public forms with file upload fields using this add-on.
Affected
- SaturdayDrive Ninja Forms - File Uploads (WordPress add-on)
- Versions 0 through 3.3.36
Fixed in
Unknown. No vendor-confirmed fixed version was found.
Workaround
Unknown. No vendor workaround confirmed.
- Disable the add-on if no public upload forms need it.
- Disable S3, Dropbox and Google Drive integrations for affected forms.
- Set wp-config.php to read-only and alert on its deletion or modification.
Exploitation
- Not known to be exploited in the wild according to OffSeq (aggregator view, not verified against CISA KEV).
- No public proof of concept found in the research.
Our recommendation
- Identify all sites that use this add-on and its version.
- Treat sites on 3.3.36 or earlier as vulnerable until the vendor confirms a fix, and update as soon as one is available.
- Apply the interim measures above and check for a missing wp-config.php or access to the setup screen.
- Monitor the Wordfence and NVD records, as the NVD status is still Deferred.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
im0xfay/CVE-2026-126537
Research sources
- CVE Record CVE-2026-126537 www.cve.org
- Wordfence threat intelligence record www.wordfence.com
- Ninja Forms File Uploads product page ninjaforms.com
- OffSeq threat radar entry radar.offseq.com
- Strix CVE-2026-92820 (related S3 flow) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:21.
Original description (NVD)
The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php — which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress — and NF_FU_External_Abstracts_Service::process_upload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends upload_id. By omitting upload_id, an attacker's data[file_path] survives into the Background Upload queue and is used by both upload_file_to_s3() (as SourceFile) and the maybe_delete_server_file() unlink() call in includes/external/abstracts/backgroundupload.php, with no canonicalization or upload-directory containment check (the plugin's own is_path_within_upload_dir() helper is only applied on admin paths). This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible — specifically, deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.