Executive brief
The Ninja Forms - File Uploads plugin for WordPress, which allows users to upload files through web forms, contains a security flaw that allows unauthorized access to server files. An attacker can exploit this to receive sensitive system files as email attachments by manipulating form submission data. This could lead to the exposure of configuration files, passwords, or other private data stored on the website's server.
Technical details
The vulnerability is an Arbitrary File Read bug rooted in the get_files_for_attachment() function. When a client-supplied 'saveProgress' flag causes the process() method to return early, the plugin accepts a raw, attacker-controlled 'files' array. This bypasses standard upload validation, path normalization, and database record creation. An attacker can provide a specific 'file_path' value which is then passed to the WordPress wp_mail() function as an attachment after only a simple file_exists() check. This allows unauthenticated remote attackers to read any file on the server that the web server process has permissions to access.
Affected products
- SaturdayDrive Ninja Forms - File Uploads <= 3.3.29
Timeline
- 2026-07-02: disclosed: Published by Wordfence and NVD
References
- https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/fields/upload.php
- https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/integrations/ninjaforms/attachments.php
- https://plugins.trac.wordpress.org/browser/ninja-forms-uploads/trunk/includes/integrations/ninjaforms/attachments.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/87d4dd4a-b1e2-4d08-aef1-77e58aa7531d?source=cve