{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0740", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-08T16:45:37.724Z", "datePublished": "2026-04-07T04:25:58.604Z", "dateUpdated": "2026-04-08T16:34:50.670Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:50.670Z"}, "affected": [{"vendor": "SaturdayDrive", "product": "Ninja Forms - File Uploads", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.26", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27."}], "title": "Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0b606ded-ab50-486a-9337-97ee9f452f12?source=cve"}, {"url": "https://ninjaforms.com/extensions/file-uploads/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "S\u00e9lim Lanouar"}], "timeline": [{"time": "2026-01-08T17:39:24.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-06T15:57:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T14:31:20.750678Z", "id": "CVE-2026-0740", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T15:08:33.660Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0740", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T14:31:20.750678Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:34:07.650Z"}}], "cna": {"title": "Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload", "credits": [{"lang": "en", "type": "finder", "value": "S\u00e9lim Lanouar"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "SaturdayDrive", "product": "Ninja Forms - File Uploads", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.26"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-08T17:39:24.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-06T15:57:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0b606ded-ab50-486a-9337-97ee9f452f12?source=cve"}, {"url": "https://ninjaforms.com/extensions/file-uploads/"}], "descriptions": [{"lang": "en", "value": "The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-07T04:25:58.604Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0740", "state": "PUBLISHED", "dateUpdated": "2026-04-07T15:08:33.660Z", "dateReserved": "2026-01-08T16:45:37.724Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-07T04:25:58.604Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27."}], "id": "CVE-2026-0740", "lastModified": "2026-04-07T13:20:11.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-07T05:16:06.897", "references": [{"source": "security@wordfence.com", "url": "https://ninjaforms.com/extensions/file-uploads/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0b606ded-ab50-486a-9337-97ee9f452f12?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.26]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Ninja Forms - File Uploads", "source": "cna", "vendor": "SaturdayDrive"}, "product": "ninja_forms_-_file_uploads", "vendor": "saturdaydrive"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-07T10:21:12.591804+00:00", "value": {"mitigation_remediation": ["Update the Ninja Forms \u2013 File Uploads plugin to version\u202f3.3.27 or later."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via Unauthenticated Arbitrary File Upload"}, "threat_synthesis": {"affected_systems": "The issue affects the Ninja Forms \u2013 File Uploads WordPress extension supplied by SaturdayDrive. All releases up to and including version\u202f3.3.26 are susceptible. Version\u202f3.3.25 discloses a partial mitigation, while the full fix is available only from version\u202f3.3.27 onward.", "description_and_impact": "This vulnerability allows an attacker to upload any file to the server because the plugin does not validate the file type in the upload handler. By uploading a malicious script, an attacker can potentially execute code on the host, compromising confidentiality, integrity, and availability. The weakness is identified as CWE\u2011434, an unrestricted upload of a potentially dangerous file type.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a high\u2011severity vulnerability, and the lack of EPSS data does not diminish its danger. Because the upload endpoint is publicly accessible without authentication, the likelihood of exploitation is high. Attackers that successfully upload a malicious file can run arbitrary code on the server, potentially taking over the site."}}}}, "created": "2026-04-07T09:36:23.370285+00:00", "updated": "2026-04-08T19:50:08.098271+00:00", "vendors": ["saturdaydrive", "saturdaydrive$PRODUCT$ninja_forms_-_file_uploads", "wordpress", "wordpress$PRODUCT$wordpress"]}