EUVD-2026-123410

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process in includes/fields/upload.php — which returns early...

VulnCheck KEV: CVE-2026-126537

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36. The flaw spans NFFUFieldsUpload::process in includes/fields/upload.php — which returns early...

PT-2026-145209

Name of the Vulnerable Software and Affected Versions Ninja Forms - File Uploads versions prior to 3.3.37 Description The Ninja Forms - File Uploads add-on for WordPress allows unauthenticated attackers to delete arbitrary files on the server or perform arbitrary file reads via exfiltration to S3...