Ninja Forms: 50,000 WordPress Sites Exposed to Critical Ninja Forms File Upload RCE Vulnerability

Critical Ninja Forms Plugin Flaw Exposes 50,000 WordPress Sites to Takeover

A severe security vulnerability in the Ninja Forms – File Upload WordPress plugin (CVE-2026-0740) has left approximately 50,000 websites at risk of complete compromise. The flaw, rated 9.8 on the CVSS scale, was discovered by security researcher Sélim Lanouar, who earned a $2,145 bug bounty for the report.

The vulnerability is classified as an unauthenticated arbitrary file upload, allowing attackers to upload malicious files to vulnerable sites without requiring credentials. Exploitation could lead to remote code execution (RCE), giving threat actors full control over the affected web server. From there, attackers could steal sensitive data, inject malware, redirect visitors to malicious sites, or use the server as a launchpad for further attacks.

The issue stems from a flaw in the plugin’s handle_upload() function, which processes file submissions. While the plugin attempts to verify file types, it fails to properly sanitize filenames or validate extensions during the move_uploaded_file() operation. This oversight enables path traversal attacks, allowing attackers to upload malicious .php files such as webshells directly into a site’s root directory, bypassing security checks.

The vulnerability affects all versions of the Ninja Forms File Upload plugin up to 3.3.26. Wordfence deployed firewall protections for premium users on January 8, 2026, extending coverage to free users by February 7. The developers released a partial fix in version 3.3.25 and a complete patch in version 3.3.27 on March 19, 2026.

Due to the flaw’s ease of exploitation requiring no authentication unpatched sites remain prime targets for automated scanning tools. Administrators are urged to update to the latest version immediately to mitigate risk.

Source: https://cybersecuritynews.com/50000-wordpress-sites-exposed/

Ninja Forms cybersecurity rating report: https://www.rankiteo.com/company/ninja-forms

"id": "NIN1775550492",
"linkid": "ninja-forms",
"type": "Vulnerability",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Various',
                        'location': 'Global',
                        'name': 'WordPress sites using Ninja Forms – File '
                                'Upload plugin',
                        'size': 'Approximately 50,000 sites',
                        'type': 'Websites'}],
 'attack_vector': 'Unauthenticated arbitrary file upload',
 'customer_advisories': 'Administrators urged to update the plugin '
                        'immediately.',
 'data_breach': {'data_exfiltration': 'Possible',
                 'file_types_exposed': 'Malicious .php files (webshells)',
                 'personally_identifiable_information': 'Possible if sensitive '
                                                        'data is stolen',
                 'sensitivity_of_data': 'High (if exfiltrated)',
                 'type_of_data_compromised': 'Sensitive data (potential)'},
 'date_detected': '2026-01-08',
 'date_resolved': '2026-03-19',
 'description': 'A severe security vulnerability in the Ninja Forms – File '
                'Upload WordPress plugin (CVE-2026-0740) has left '
                'approximately 50,000 websites at risk of complete compromise. '
                'The flaw allows unauthenticated arbitrary file uploads, '
                'leading to remote code execution (RCE) and full server '
                'takeover.',
 'impact': {'brand_reputation_impact': 'Potential brand reputation damage',
            'data_compromised': 'Sensitive data theft possible',
            'identity_theft_risk': 'Possible if sensitive data is stolen',
            'operational_impact': 'Full server compromise, malware injection, '
                                  'redirection to malicious sites',
            'payment_information_risk': 'Possible if sensitive data is stolen',
            'systems_affected': 'WordPress sites using Ninja Forms – File '
                                'Upload plugin'},
 'investigation_status': 'Resolved',
 'lessons_learned': 'Importance of proper file sanitization and validation in '
                    'plugins to prevent arbitrary file uploads and path '
                    'traversal attacks.',
 'post_incident_analysis': {'corrective_actions': 'Patch released in version '
                                                  '3.3.27 to fix the arbitrary '
                                                  'file upload vulnerability.',
                            'root_causes': 'Flaw in the plugin’s '
                                           '`handle_upload()` function, '
                                           'improper file type validation and '
                                           'sanitization, and path traversal '
                                           'vulnerability.'},
 'recommendations': 'Immediately update the Ninja Forms – File Upload plugin '
                    'to version 3.3.27 or later. Deploy web application '
                    'firewalls (WAF) to mitigate exploitation attempts.',
 'references': [{'source': 'Security researcher Sélim Lanouar'},
                {'source': 'Wordfence'}],
 'response': {'containment_measures': 'Firewall protections deployed by '
                                      'Wordfence',
              'remediation_measures': 'Plugin update to version 3.3.27',
              'third_party_assistance': 'Wordfence (firewall protections)'},
 'title': 'Critical Ninja Forms Plugin Flaw Exposes 50,000 WordPress Sites to '
          'Takeover',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-0740'}