Directory Traversal Vulnerability in Ninja Forms Excel Export Plugin for WordPress

CVE-2026-15160

What is CVE-2026-15160?

The Ninja Forms - Excel Export plugin for WordPress is prone to a Directory Traversal vulnerability that allows authenticated users, with subscriber-level access or higher, to manipulate the 'spreadsheet_export_tmp_name' parameter. This exploitation enables attackers to create .xls/.xlsx files in arbitrary locations on the server, potentially leading to further server compromise or data exposure. Users of affected versions up to and including 3.3.6 are advised to review their access permissions and apply necessary updates to secure their environments.

References