Arbitrary File Deletion Vulnerability in Ninja Forms File Uploads for WordPress

CVE-2026-126537

What is CVE-2026-126537?

The Ninja Forms - File Uploads add-on for WordPress presents a security flaw that allows unauthenticated attackers to delete arbitrary files from a site's server. This vulnerability arises due to improper handling of client-supplied file data during uploads. Specifically, if an attacker omits the required upload_id when submitting files, the plugin fails to properly validate and control the file paths. As a result, files can be queued for upload without necessary checks, making it possible to remove critical files such as wp-config.php. This exploitation could lead to total site compromise, as it may force the site into its setup state, enabling unauthorized access and control. To mitigate this risk, users should upgrade to the latest version of the Ninja Forms - File Uploads add-on.

References