CVE-2026-0740: Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NFFUAJAXControllersUploads::handleupload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0740?
CVE-2026-0740 is considered a critical vulnerability as it allows unauthenticated arbitrary file uploads.
How do I fix CVE-2026-0740?
To fix CVE-2026-0740, update the Ninja Forms - File Uploads plugin to version 3.3.27 or later, which addresses the vulnerability.
What types of files can be uploaded due to CVE-2026-0740?
Due to CVE-2026-0740, attackers can potentially upload any file type, including executable files.
Is my website at risk if I use Ninja Forms - File Uploads version 3.3.26 or earlier?
Yes, if you are using Ninja Forms - File Uploads version 3.3.26 or earlier, your website is at risk due to CVE-2026-0740.
What action should I take immediately regarding CVE-2026-0740?
Immediately update the Ninja Forms - File Uploads plugin to the latest version to mitigate the risk posed by CVE-2026-0740.