CVE-2026-13369: Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attachfiles() function in versions up to, and including, 3.3.29. This is due to the getfilesforattachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied filepath value to reach wpmail() as an email attachment with only a fileexists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13369?
The severity of CVE-2026-13369 is high with a CVSS score of 7.5.
How do I fix CVE-2026-13369?
To fix CVE-2026-13369, update the Ninja Forms - File Uploads plugin to the latest version beyond 3.3.29.
What type of vulnerability is CVE-2026-13369?
CVE-2026-13369 is a Path Traversal vulnerability that allows for unauthenticated arbitrary file read.
Which versions of Ninja Forms are affected by CVE-2026-13369?
Ninja Forms - File Uploads versions up to and including 3.3.29 are affected by CVE-2026-13369.
What functionality is exploited in CVE-2026-13369?
CVE-2026-13369 exploits the attach_files() function in the Ninja Forms - File Uploads plugin.