50,000 WordPress Sites Running Ninja Forms Vulnerable to Critical File Upload RCE

A severe security flaw has been discovered in the Ninja Forms File Upload plugin, a widely utilized WordPress add-on that allows website administrators to accept documents, images, and other media from their visitors.

Tracked officially as CVE-2026-0740, this unauthenticated arbitrary file upload vulnerability carries a maximum critical CVSS score of 9.8.

With an estimated 50,000 active WordPress installations currently utilizing this extension, the flaw presents a massive attack surface for cybercriminals aiming to compromise vulnerable web servers.

The critical vulnerability was discovered by security researcher Sélim Lanouar, who responsibly reported the issue through the Wordfence Bug Bounty Program on January 8, 2026.

Recognizing the severe threat posed by the bug, Wordfence awarded Lanouar a bounty of $2,145.

This discovery highlights the immense value of independent security research in identifying easily exploitable flaws before threat actors can weaponize them in widespread automated exploitation campaigns.

Technical Breakdown of the Exploit

Technical analysis of the vulnerability reveals a significant oversight in how the plugin validates incoming data.

The vulnerability is rooted in the code responsible for handling the upload via the plugin’s AJAX controller class.

While the developers successfully implemented a file type check on the initial source filename, they critically failed to verify the file extension on the destination filename right before the application executes the move operation to save the file to the server.

Because the plugin does not properly sanitize this final destination filename, attackers can completely bypass intended security filters.

This oversight allows any unauthenticated site visitor to upload highly dangerous executable files, such as malicious PHP scripts, instead of standard safe documents.

Furthermore, the absence of strict path sanitization enables threat actors to utilize path traversal techniques.

By manipulating the upload request, hackers can force the server to save their malicious payloads directly into the website’s root directory, escaping isolated and restricted upload folders entirely.

Once a malicious PHP script is saved to an accessible location on the server, the attacker simply needs to navigate to that file’s URL in their browser to trigger its execution.

This sequence grants the attacker Remote Code Execution capabilities, effectively handing over complete administrative control of the hosting environment.

From this position, hackers can quietly install persistent webshells, siphon out sensitive database credentials, inject malicious SEO spam, or deploy ransomware across the entire network architecture.

Following the initial January disclosure, Wordfence rapidly deployed virtual firewall patches to its premium users to proactively block exploit attempts.

The plugin’s vendor initiated the patching process by releasing a partial fix in version 3.3.25 on February 10, 2026.

The vulnerability was ultimately fully resolved with the release of version 3.3.27 on March 19, 2026.

Website administrators running any version of the Ninja Forms File Upload extension up to 3.3.26 must immediately upgrade to version 3.3.27 to protect their digital infrastructure from imminent compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.