CVE-2026-13369

Name of the Vulnerable Software and Affected Versions Ninja Forms - File Uploads versions prior to 3.3.30

Description Unauthenticated attackers can read arbitrary files on the server. This occurs because the attach files() function utilizes the get files for attachment() function, which accepts a raw attacker-controlled files array. When the process() method returns early due to a client-supplied saveProgress flag, the system bypasses upload validation, path normalization, and database record creation. Consequently, an attacker-supplied file path value can be passed to wp mail() as an email attachment, subject only to a file exists() check.

Recommendations Update Ninja Forms - File Uploads to version 3.3.30 or later. As a temporary mitigation, restrict access to the attach files() function.