CVE-2026-0740

This issue means the plugin’s “upload” feature doesn’t properly restrict what file types can be uploaded and who is allowed to upload. Imagine a store that lets anyone walk up to the back door and drop off packages—those packages might include dangerous items that let an attacker get inside and control the system.

In the worst case, uploaded files can be crafted to let attackers run commands on your server.

This matters if you run WordPress and use the Ninja Forms - File Uploads plugin, especially if your version is 3.3.26 or older. Because the upload is unauthenticated, attackers do not need a username or password.

The risk applies when an attacker can reach the plugin’s upload functionality from the internet (the vulnerable upload handler is exposed publicly as part of the site).

This is RED because the vulnerability is critical and can allow attackers to upload files without logging in, which can quickly escalate to full site compromise. Our traffic signals show rising incident-related attention, and the likelihood of exploitation is high.

Act now by upgrading immediately; delaying increases the chance attackers try it against exposed sites.