CVE-2026-15160

Name of the Vulnerable Software and Affected Versions Ninja Forms - Excel Export versions prior to 3.3.7

Description An issue exists where authenticated users with subscriber-level access and above can perform Directory Traversal. By manipulating the spreadsheet export tmp name parameter, an attacker can write .xls or .xlsx files to arbitrary locations on the server, potentially facilitating further attacks. Directory Traversal is a flaw that allows an attacker to access or manipulate files and directories outside the intended folder.

Recommendations Update the plugin to a version newer than 3.3.6. Restrict the use of the spreadsheet export tmp name parameter to prevent unauthorized file writes.