Quick answers
- Is CVE-2026-92820 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-92820 being exploited in the wild.
- How severe is CVE-2026-92820?
- High severity, with a CVSS score of 8.1, published 2 October 2026.
- Which products and versions are affected?
- Ninja Forms File Uploads up to 3.3.34.
- Is there a fix for CVE-2026-92820?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-92820 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-92820?
- Check whether you run Ninja Forms File Uploads at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The plugin trusts attacker-supplied file paths from form submissions and uses them without validation in three ways: to attach files to notification emails (arbitrary file read), to write fetched content via the external S3 upload flow (arbitrary file write/RCE), and in scheduled deletion tasks (arbitrary file deletion). Exploitation requires the External File Upload (Amazon S3) action to be configured; the read variant additionally requires email attachments enabled. An unauthenticated attacker can manipulate the file_path parameter to access any file on the server.
Affected products
- Ninja Forms File Uploads up to 3.3.34
Timeline
- 2026-10-02: disclosed