PT-2026-54945 · Saturday Drive · Ninja Forms - File Uploads

Daroo · Publicado 2026-07-02 · Atualizado 2026-07-02 · CVE-2026-13369

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach files() function in versions up to, and including, 3.3.29. This is due to the get files for attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file path value to reach wp mail() as an email attachment with only a file exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-13369

Produtos afetados

Ninja Forms - File Uploads

Referências · 5

• https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/fields/upload.php#L71 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/87d4dd4a-b1e2-4d08-aef1-77e58aa7531d?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/integrations/ninjaforms/attachments.php#L196 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-13369 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/integrations/ninjaforms/attachments.php#L107 · Nota