CVE-2026-126537

Name of the Vulnerable Software and Affected Versions Ninja Forms - File Uploads versions prior to 3.3.37

Description The Ninja Forms - File Uploads add-on for WordPress allows unauthenticated attackers to delete arbitrary files on the server or perform arbitrary file reads via exfiltration to S3, Dropbox, or Google Drive. The issue exists in the NF FU Fields Upload::process() function within includes/fields/upload.php and the NF FU External Abstracts Service::process upload() function within includes/external/abstracts/service.php. By omitting the upload id variable, an attacker can ensure that the data[file path] variable persists in the Background Upload queue. This value is subsequently used by the upload file to s3() function as the SourceFile and by the maybe delete server file() function's unlink() call in includes/external/abstracts/backgroundupload.php without proper canonicalization or directory containment checks. Deleting critical files such as wp-config.php can force the application into its setup screen, potentially leading to full site takeover and remote code execution.

Recommendations Update Ninja Forms - File Uploads to version 3.3.37 or later. As a temporary workaround, restrict access to the NF FU Fields Upload::process() and NF FU External Abstracts Service::process upload() functions.