# CVE-2026-57784: Ninja Forms File Uploads Extension CSRF

Source: https://junglewise.ai/threats/cve-2026-57784-ninja-forms-file-uploads-extension-csrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-57784 · Severity: critical · CVSS 9.6 · Published 2026-07-23

A vulnerability exists in the File Uploads extension for Ninja Forms, a popular WordPress form builder. This flaw allows an attacker to trick an administrator or other authorized user into performing unintended actions on the website, such as changing settings or deleting data, simply by getting them to click a malicious link. If successful, this could lead to a full takeover of the website or significant data loss.

Vendors: [Ninja Forms](https://junglewise.ai/threats/vendors/ninja-forms).

## Quick answers

**Is CVE-2026-57784 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57784 being exploited in the wild.

**How severe is CVE-2026-57784?** Critical severity, with a CVSS score of 9.6, published 23 July 2026.

**Which products and versions are affected?** Ninja Forms File Uploads Extension <= 3.3.26.

**Is there a fix for CVE-2026-57784?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57784 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57784?** Check whether you run Ninja Forms File Uploads Extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Ninja Forms File Uploads Extension plugin for WordPress (versions <= 3.3.26). The issue stems from a lack of proper nonce validation or equivalent CSRF protections within the plugin's administrative or file-handling functions. An unauthenticated remote attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it via social engineering (e.g., a phishing link). Successful exploitation can lead to unauthorized configuration changes, file manipulation, or full site compromise due to the 'Changed Scope' (S:C) and high impact on confidentiality, integrity, and availability. As of the advisory date, no official patch has been confirmed.

## Affected products

- Ninja Forms Ninja Forms File Uploads Extension <= 3.3.26

## Timeline

- 2026-03-09: other: Vulnerability reported by researcher Marc-André Beaulieu
- 2026-04-08: advisory: Initial advisory published by Patchstack
- 2026-07-23: disclosed: CVE-2026-57784 published to the NVD dataset

## References

- [https://patchstack.com/database/wordpress/plugin/ninja-forms-uploads/vulnerability/wordpress-ninja-forms-file-uploads-extension-plugin-3-3-26-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/ninja-forms-uploads/vulnerability/wordpress-ninja-forms-file-uploads-extension-plugin-3-3-26-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)