# CVE-2026-126537: Ninja Forms File Uploads arbitrary file deletion

Source: https://junglewise.ai/threats/cve-2026-126537-the-ninja-forms-file-uploads-add-on-for-wordpress-is-vulnerable  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126537 · Severity: critical · CVSS 9.1 · Published 2026-11-11

The File Uploads add-on for the Ninja Forms WordPress plugin allows unauthenticated attackers to delete arbitrary files from the affected website's server. An attacker can exploit this by crafting a malicious form submission that bypasses file path validation, potentially deleting critical files such as wp-config.php, which would force WordPress into setup mode and enable complete site takeover and data theft.

Vendors: [Ninja Forms](https://junglewise.ai/threats/vendors/ninja-forms).

## Quick answers

**Is CVE-2026-126537 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126537 being exploited in the wild.

**How severe is CVE-2026-126537?** Critical severity, with a CVSS score of 9.1, published 11 November 2026.

**Which products and versions are affected?** Ninja Forms File Uploads up to 3.3.36.

**Is there a fix for CVE-2026-126537?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126537 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126537?** Check whether you run Ninja Forms File Uploads at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the upload.php and backgroundupload.php components, where missing upload_id parameter validation and lack of path canonicalization allow client-supplied file paths to reach the unlink() call without directory containment checks. An unauthenticated attacker can omit the upload_id field and supply an arbitrary data[file_path] during form submission, which is processed by the background upload queue without proper validation against the upload directory restrictions that are only enforced for administrative paths.

## Affected products

- Ninja Forms File Uploads up to 3.3.36

## Timeline

- 2026-11-11: disclosed

## References

- [https://ninjaforms.com/extensions/file-uploads/](https://ninjaforms.com/extensions/file-uploads/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/3670e2aa-6d8e-4ba5-ab65-49bd2a3dcacc?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/3670e2aa-6d8e-4ba5-ab65-49bd2a3dcacc?source=cve)

## Related threats

- [Ninja Forms File Uploads arbitrary file operations in Amazon S3 flow](https://junglewise.ai/threats/cve-2026-92820-the-ninja-forms-file-uploads-plugin-for-wordpress-is-vulnerable)