CVE-2026-126537 is a critical (CVSS 9.1) path traversal flaw in the Ninja Forms - File Uploads add-on for WordPress. Through version 3.3.36 it lets unauthenticated attackers delete arbitrary files on the server. Depending on how the site is set up, deleting the right file may lead to a full site takeover.
What Is It
The flaw is an arbitrary file deletion bug (CWE-22). According to the advisory, it may also allow arbitrary file reads, because server files can be copied out to S3, Dropbox or Google Drive. This read path appears to depend on which cloud storage integration the site has configured. The flaw comes from two pieces of code:
NF_FU_Fields_Upload::process()inincludes/fields/upload.phpreturns early when a public submission includes a non-emptyextra.saveProgressvalue. When that happens, the client-suppliedfiles[]data is left in place.NF_FU_External_Abstracts_Service::process_upload()inincludes/external/abstracts/service.phponly reloads the trusted file path when the client sendsupload_id.
If an attacker leaves out upload_id, their own data[file_path] value ends up in the Background Upload queue. Two functions then use it:
upload_file_to_s3()uses it asSourceFile.maybe_delete_server_file()passes it tounlink()inincludes/external/abstracts/backgroundupload.php.
Neither step canonicalizes the path or checks that it stays inside the upload directory. The plugin's own is_path_within_upload_dir() helper is only used on admin paths.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N. That means it can be exploited over the network, attack complexity is low, and no login or user interaction is needed. Integrity and availability impact are both rated High.
According to NVD, deleting files may make remote code execution possible. For example, deleting wp-config.php sends WordPress back to its setup screen. On many sites, an attacker could then complete that setup and take over the site, though this depends on the hosting and server configuration. Depending on which cloud storage integration is configured, the read path may also let an attacker copy server files out to cloud storage.
The supplied CISA KEV entry is empty, so the provided data does not confirm active exploitation. The NVD record status is "Deferred."
What's Vulnerable
- Vendor: SaturdayDrive
- Product: Ninja Forms - File Uploads (WordPress add-on)
- Affected versions: all versions up to and including 3.3.36
Patch Status
The supplied NVD data does not name a fixed version, and there is no CISA required action because the KEV entry is empty. Administrators running version 3.3.36 or earlier should check the vendor's extension page and the Wordfence advisory for an update. Until a fix is confirmed and installed, consider disabling the add-on.