Attackers Actively Exploiting Critical Vulnerability in Ninja Forms — File Upload Plugin

Attackers Actively Exploiting Critical Vulnerability in Ninja Forms — File Upload Plugin

On April 6th, 2026, the Wordfence Intelligence Vulnerability Database publicly disclosed a critical arbitrary file upload vulnerability in the Ninja Forms — File Upload plugin for WordPress.

This vulnerability, tracked as CVE-2026–0740 with a CVSS score of 9.8, affects all versions of the plugin up to and including 3.3.26. The plugin has an estimated 50,000 active installations.

What makes this disclosure particularly noteworthy is that attackers began exploiting the vulnerability the same day it was publicly disclosed.

The Wordfence Firewall has since blocked over 118,600 exploit attempts targeting this specific vulnerability, with mass exploitation occurring between April 9th and 13th, 2026.

The vulnerability was discovered by Selim Lanouar (whattheslime), who earned a $2,145.00 bounty through the Wordfence Bug Bounty Program.

Special thanks to Marco Wotschka, a Vulnerability Researcher at Wordfence, for his assistance gathering and analyzing the attack data related to this vulnerability.

Vulnerability Details

The Ninja Forms — File Upload plugin is vulnerable to arbitrary file uploads due to missing file type validation in the `NF_FU_AJAX_Controllers_Uploads::handle_upload` function. While the plugin validates the file type based on the source filename, it fails to perform any file type or extension checks on the destination filename before moving the uploaded file.

Combined with the lack of filename sanitization, this allows an unauthenticated attacker to upload a file with a .php extension and leverage path traversal to place it anywhere on the server, including the webroot. This leads to remote code execution.

• CVE: CVE-2026–0740
• CVSS: 9.8 (Critical)
• Type: Unauthenticated Arbitrary File Upload
• Affected Versions: <= 3.3.26
• Patched Version: 3.3.27

Impact

With an estimated 50,000 active installations, this vulnerability has a broad potential impact across the WordPress ecosystem. The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, to affected servers. This can lead to complete site compromise through the use of webshells and other techniques.

Analysis of the attack data reveals that threat actors are uploading a variety of malicious payloads, including PHP webshells disguised as PDF or image files, minimal footprint file uploaders, and malicious .htaccess files designed to make non-PHP files executable on Apache servers.

These techniques allow attackers to hide shells and backdoors in files with otherwise harmless extensions.

The top offending IP address alone was responsible for over 53,000 blocked requests.

Patch Status

The vendor released a fully patched version of the plugin (3.3.27) on March 19th, 2026. The vulnerability was partially patched in version 3.3.25 and fully resolved in version 3.3.27.

Sites running version 3.3.26 or earlier should update to version 3.3.27 as soon as possible to maintain normal functionality and close this attack vector.

Site administrators who believe their site may have been compromised should review the webroot and `/wp-content/uploads` directories for any suspicious or unknown PHP files. Access logs should also be reviewed for requests to `/wp-admin/admin-ajax.php?action=nf_fu_upload`.

Protection

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against exploits targeting this vulnerability on January 8, 2026. Sites using the free version of Wordfence received the same protection 30 days later on February 7, 2026.

Wordfence also allows its users to scan files outside of WordPress and to scan images, binary, and other files, which can help identify malicious uploads associated with this vulnerability.

For sites that may have already been compromised, Wordfence offers incident response services through Wordfence Care (business hours support) and Wordfence Response (24/7/365 availability with a 1-hour response time). Both options include a thorough malware investigation, cleanup, and post-incident search engine security review.

Conclusion

This critical-severity vulnerability in Ninja Forms — File Upload represents a significant concern due to both its severity and the confirmed active exploitation in the wild.

The combination of unauthenticated access, arbitrary file upload capability, and path traversal makes this vulnerability straightforward to exploit with potentially devastating consequences.

Review the report to ensure your site is not affected.

Originally published on the [Wordfence Blog](https://www.wordfence.com/blog/2026/04/attackers-actively-exploiting-critical-vulnerability-in-ninja-forms-file-upload-plugin).