Arbitrary File Operations in Ninja Forms File Uploads Plugin for WordPress

CVE-2026-92820

What is CVE-2026-92820?

The Ninja Forms - File Uploads plugin for WordPress is susceptible to arbitrary file operations due to inadequate validation of attacker-supplied file paths in the upload process. This vulnerability enables unauthenticated users to read, write, or delete files on the server when the External File Upload feature is utilized, especially when coupled with an email action that attaches uploaded files. The exploitation can lead to significant security breaches, allowing malicious actors to execute arbitrary code or manipulate server data.

References