CVE-2026-126537

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process in includes/fields/upload.php — which returns early...