Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

ninja-form-exploit

ninja-form-exploit CVE-2026-0740 — Multi-threaded vulnerability scanner for the Ninja Forms File Upload path traversal issue on WordPress. Description main.py scans a list of WordPress targets to determine whether the Ninja Forms File Uploads plugin is vulnerable to CVE-2026-0740. Brief flow: 1...

CVE-2026-0740-upload-template

This repository does not have a README...

Exploit for CVE-2026-0740

No d...

Exploit for CVE-2026-0740

ninja-form-exploit CVE-2026-0740 — Multi-threaded vulnera...

Ninja Forms Uploads - Unauthenticated PHP File Upload

Exploit Title: Ninja Forms Uploads - Unauthenticated PHP File Upload Date: 2026-04-09 Exploit Author: Sélim Lanouar @whattheslime Vendor Homepage: https://ninjaforms.com/ Software Link: https://ninjaforms.com/extensions/file-uploads/ Version: 3.3.24 Tested on: WordPress 6.9.3 on Apache and Nginx...

Exploit for CVE-2026-0740

No d...

Exploit for CVE-2026-0740

CVE-2026-0740 🧩 Overview CVE-2026-0740 is an un...

Attackers Actively Exploiting Critical Vulnerability in Ninja Forms – File Upload Plugin

On April 6th, 2026, we publicly disclosed a critical Arbitrary File Upload vulnerability in Ninja Forms – File Upload, a WordPress plugin with an estimated 50,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP...

VulnCheck KEV: CVE-2026-0740

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NFFUAJAXControllersUploads::handleupload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload...