The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attachfiles() function in versions up to, and including, 3.3.29. This is due to the getfilesforattachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied filepath value to reach wpmail() as an email attachment with only a fileexists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.