Is CVE-2026-57784 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57784 being exploited in the wild.

How severe is CVE-2026-57784?

Critical severity, with a CVSS score of 9.6, published 23 July 2026.

Which products and versions are affected?

Ninja Forms File Uploads Extension <= 3.3.26.

Is there a fix for CVE-2026-57784?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57784 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57784?

Check whether you run Ninja Forms File Uploads Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57784: Ninja Forms File Uploads Extension CSRF

Q: Is there a fix for CVE-2026-57784?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-57784 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57784?

Check whether you run Ninja Forms File Uploads Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57784 · Severity: critical · CVSS 9.6 · Published 2026-07-23

A vulnerability exists in the File Uploads extension for Ninja Forms, a popular WordPress form builder. This flaw allows an attacker to trick an administrator or other authorized user into performing unintended actions on the website, such as changing settings or deleting data, simply by getting them to click a malicious link. If successful, this could lead to a full takeover of the website or significant data loss.

Vendors: Ninja Forms.

Quick answers

Is CVE-2026-57784 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57784 being exploited in the wild.
How severe is CVE-2026-57784?: Critical severity, with a CVSS score of 9.6, published 23 July 2026.
Which products and versions are affected?: Ninja Forms File Uploads Extension <= 3.3.26.
Is there a fix for CVE-2026-57784?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57784 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57784?: Check whether you run Ninja Forms File Uploads Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Ninja Forms File Uploads Extension plugin for WordPress (versions <= 3.3.26). The issue stems from a lack of proper nonce validation or equivalent CSRF protections within the plugin's administrative or file-handling functions. An unauthenticated remote attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it via social engineering (e.g., a phishing link). Successful exploitation can lead to unauthorized configuration changes, file manipulation, or full site compromise due to the 'Changed Scope' (S:C) and high impact on confidentiality, integrity, and availability. As of the advisory date, no official patch has been confirmed.

Affected products

Ninja Forms Ninja Forms File Uploads Extension <= 3.3.26

Timeline

2026-03-09: other: Vulnerability reported by researcher Marc-André Beaulieu
2026-04-08: advisory: Initial advisory published by Patchstack
2026-07-23: disclosed: CVE-2026-57784 published to the NVD dataset

References

https://patchstack.com/database/wordpress/plugin/ninja-forms-uploads/vulnerability/wordpress-ninja-forms-file-uploads-extension-plugin-3-3-26-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.