PT-2026-54945 · Saturday Drive · Ninja Forms - File Uploads

Daroo · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-13369

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach files() function in versions up to, and including, 3.3.29. This is due to the get files for attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file path value to reach wp mail() as an email attachment with only a file exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-13369

Affected Products

Ninja Forms - File Uploads

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-13369 · Security Note
• https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/fields/upload.php#L71 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/87d4dd4a-b1e2-4d08-aef1-77e58aa7531d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/integrations/ninjaforms/attachments.php#L196 · Note
• https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/integrations/ninjaforms/attachments.php#L107 · Note