A critical vulnerability in the Ninja Forms Uploads WordPress plugin allows unauthenticated attackers to upload arbitrary PHP files — including web shells — to the server. The issue is tracked as CVE-2026-0740.
Version 3.3.24 is affected. The attack doesn’t require any credentials. Here’s how it works: an attacker requests a nonce via admin-ajax.php with the action nf_fu_get_new_nonce, then uses that nonce to upload a file through nf_fu_upload. By manipulating the filename parameter (using path traversal like ../../../webshell.php) and setting the MIME type to image/jpeg, the plugin saves the file with a .php extension in a web-accessible directory.
Full remote code execution follows. The researcher demonstrated this by uploading a simple system($_GET["cmd"]) webshell and executing the id command. Tested against WordPress 6.9.3 on both Apache and Nginx.
This is about as bad as WordPress plugin vulnerabilities get. No auth needed. Direct code execution. If you’re running Ninja Forms with the Uploads extension at version 3.3.24, check for updates immediately and audit your uploads directory for unexpected PHP files.
