IT SBIT Services
Schneeberger
DEEN
CVE tracker

Ninja Forms - File Uploads: Arbitrary file read, write and delete

CVE-2026-92820High 8.1

← All vulnerabilities

Summary

Versions up to and including 3.3.34 of the Ninja Forms - File Uploads WordPress add-on trust a file path supplied in a form submission when the External File Upload (Amazon S3) action is used. An unauthenticated attacker can thereby read files via a form notification email, write files (which can lead to remote code execution when the external store is configured) and delete files on the server. The read variant additionally requires a form Email action that attaches the uploaded file.

Affected

  • Ninja Forms - File Uploads (SaturdayDrive), all versions up to and including 3.3.34
  • Exploitation requires the External File Upload (Amazon S3) action to be configured in a form

Fixed in

Unknown. No fixed version is confirmed for this CVE. The vendor changelog lists version 3.3.35 (5 October 2026) with the entry 'require administrator capability for external file URL access', which may address this issue but is not confirmed. The earlier CVE-2026-0740 was fixed in 3.3.27.

Workaround

  • Disable the External File Upload (Amazon S3) action in all forms where it is not business-critical
  • Remove or review form Email actions that attach uploaded files
  • Review the S3 integration permissions and restrict file system access
  • No vendor-published workaround is known.

Exploitation

  • In the wild: nothing known at the time of writing; not listed in the CISA KEV catalog.
  • Public proof of concept: none confirmed at the time of writing.
  • CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

  • Inventory all WordPress sites using this add-on and check whether they use the S3 action or attach uploads to emails.
  • Disable the S3 action and file attachments in affected forms until a fix is confirmed.
  • Apply the vendor update as soon as it is confirmed and verify that it was actually installed, since premium plugins may not update automatically.
  • Review files and logs for unexpected changes, deletions or unusual form submissions.
  • Sites below 3.3.34 should also be reviewed for CVE-2026-0740, which was fixed in 3.3.27.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:00.

Original description (NVD)

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file_path, which is then used without validation to attach a file to the form's notification email (arbitrary file read), to write fetched content (arbitrary file write, leading to remote code execution when the external store is configured), and in a scheduled deletion (arbitrary file deletion). This makes it possible for unauthenticated attackers to read, write, or delete arbitrary files on the server. Exploitation requires the site to use the plugin's External File Upload (Amazon S3) action; the read variant additionally requires a form Email action configured to attach the uploaded file.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed