Ad4M5

**Name of the Vulnerable Software and Affected Versions** Ninja Forms - File Uploads versions prior to 3.3.30 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to read all debug log entries stored in the `wp nf3 log` table or permanently delete all rows from that table. The issue is triggered via the 'debug-log/get-all' and 'debug-log/delete-all' API endpoints. **Recommendations** Update Ninja Forms - File Uploads to a version newer than 3.3.29.