Ninja Forms File Uploads patches unauthenticated arbitrary file upload

TL;DR — A critical unauthenticated file upload bug in the Ninja Forms - File Uploads WordPress plugin can let attackers upload arbitrary files, potentially enabling remote code execution.

What happened

Ninja Forms - File Uploads is a WordPress plugin extension that adds file-upload functionality to Ninja Forms.

Wordfence published details for CVE-2026-0740, reporting an unauthenticated arbitrary file upload caused by missing file type validation in NF_FU_AJAX_Controllers_Uploads::handle_upload. Wordfence notes this can allow unauthenticated attackers to upload arbitrary files to the server, which may make remote code execution possible.

This is operationally high-risk because unauthenticated file upload paths are frequently weaponized quickly (web shells, arbitrary PHP upload, and persistence). Wordfence additionally reports it blocked 1,944 attacks targeting this vulnerability in the past 24 hours, signaling active targeting pressure.

Who is impacted

• WordPress sites running the Ninja Forms - File Uploads plugin at versions reported as affected (<= 3.3.26).
• Internet-exposed sites are higher risk due to the unauthenticated attack path.
• Any deployment where uploaded files are stored in locations reachable by the web server and/or processed by interpreters (common in WordPress environments) increases the chance of follow-on code execution.

What to do now

• Follow vendor remediation guidance and apply the patched release.

  "Remediation Update to version 3.3.27, or a newer patched version"

• If you operate a WordPress fleet, immediately inventory for the plugin slug ninja-forms-uploads (e.g., via WP-CLI, your plugin management tooling, or filesystem scanning) and prioritize internet-facing instances.
• Until rollout completes, reduce exposure of file upload surfaces where feasible (e.g., restrict access to form endpoints handling uploads) and increase monitoring for unexpected file creation in WordPress upload directories.
• If you suspect exploitation, treat it as a potential web-shell incident: preserve evidence, hunt for newly introduced files in writable directories, and rotate any secrets reachable by the WordPress runtime.