Descripción
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the -NF_FU_AJAX_Controllers_Uploads::handle_upload- function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site-s server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
CVSS 9.8EPSS 57.806999999999995%Riesgo 6.08
Ver fuente- Publicación
- 2026-04-07 05:16:06
- Versiones afectadas
- <=3.3.26
- Tipo
- Installed app
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H