CVE-2026-126537: Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'

Q: What request conditions allow an attacker-controlled path to reach the background upload processing?

The attacker needs to make a public submission with a nonempty extra.saveProgress value and provide files[].data.file_path. They must omit upload_id so the plugin does not reload an authoritative path, allowing the supplied path to remain in the background upload queue.

Q: When could this issue expose file contents in addition to deleting files?

File-read exposure is possible when the affected upload workflow sends files to S3, Dropbox, or Google Drive. The attacker-controlled file_path can be used as the source file for the external upload operation, potentially exfiltrating readable server files to the configured service.

Published Nov 11, 2026

Updated

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process() in includes/fields/upload.php — which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress — and NFFUExternalAbstractsService::processupload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends uploadid. By omitting uploadid, an attacker's data[filepath] survives into the Background Upload queue and is used by both uploadfiletos3() (as SourceFile) and the maybedeleteserverfile() unlink() call in includes/external/abstracts/backgroundupload.php, with no canonicalization or upload-directory containment check (the plugin's own ispathwithinuploaddir() helper is only applied on admin paths). This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible — specifically, deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover.

Event History

Nov 11, 2026

CVE Published

via MITRE·12:34 PM

Data Sourced

via MITRE·12:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What request conditions allow an attacker-controlled path to reach the background upload processing?

The attacker needs to make a public submission with a nonempty extra.saveProgress value and provide files[].data.file_path. They must omit upload_id so the plugin does not reload an authoritative path, allowing the supplied path to remain in the background upload queue.

When could this issue expose file contents in addition to deleting files?

File-read exposure is possible when the affected upload workflow sends files to S3, Dropbox, or Google Drive. The attacker-controlled file_path can be used as the source file for the external upload operation, potentially exfiltrating readable server files to the configured service.

CVE-2026-126537: Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'

Event History

Frequently Asked Questions

What request conditions allow an attacker-controlled path to reach the background upload processing?

When could this issue expose file contents in addition to deleting files?

Company

Resources

Contact

Frequently Asked Questions

What request conditions allow an attacker-controlled path to reach the background upload processing?

When could this issue expose file contents in addition to deleting files?