Ninja Forms File Uploads: CVE-2026-126537 Critical Flaw

What it is and who is affectedA critical vulnerability has been published in the Ninja Forms – File Uploads add-on for WordPress. It is tracked as CVE...

What it is and who is affected

A critical vulnerability has been published in the Ninja Forms – File Uploads add-on for WordPress. It is tracked as CVE-2026-126537, classified under CWE-22 (path traversal), and was published in the National Vulnerability Database (NVD) of NIST on 11 November 2026. Its severity is CVSS 3.1 score 9.1 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

The flaw affects all versions up to and including 3.3.36. Any WordPress site running this add-on within that range is exposed, whether it is a corporate site, an online shop or a small portal with a contact or application form. The attack does not require authentication: an unauthenticated visitor can reach the vulnerable code path.

In practical terms, the add-on allows arbitrary file deletion on the server, and also arbitrary file read through exfiltration towards S3, Dropbox or Google Drive. The NVD description explains that the early return in the upload processing routine leaves client-supplied file paths intact when a public submission carries a non-empty progress flag, and that the authoritative-path reload only triggers when the client sends an upload identifier. By omitting it, the attacker's path survives into the background upload queue, where it is used both as the source file for external storage and in the unlink call that removes the server copy, without canonicalisation or a check that the path stays inside the upload directory.

Why it is urgent

At the time of writing, CVE-2026-126537 does not appear in CISA's KEV catalogue, so there is no public record of it being exploited in real attacks. That does not make it a low priority. A remote, unauthenticated flaw rated critical, in a plugin used on publicly reachable forms, is exactly the kind of weakness that gets picked up quickly once proof-of-concept details circulate.

The most damaging scenario described in the advisory is the deletion of wp-config.php. Removing that file pushes WordPress back to its installation screen, which opens the door to a full site takeover. In other words, the impact is not limited to a broken form: it can mean losing the entire site, its data and its reputation with customers.

What to do today

Check whether the add-on is installed and, if so, which version it is on. Sites where nobody remembers installing it are the ones that usually stay exposed.
Update or mitigate following the vendor's advisory for the File Uploads extension. If the material you have does not state which version fixes the issue, apply whatever the official Ninja Forms notice indicates rather than guessing.
Look for signs of intrusion: unexpected redirects to the WordPress setup screen, missing configuration files, unfamiliar files in the uploads directory, or outbound connections to cloud storage you do not recognise.
Reduce what is exposed to the internet: remove or disable forms that are not in use, restrict public upload fields where possible, and keep WordPress core, themes and plugins patched as a routine.
Review access and backups: confirm that recent backups exist and that administrator accounts, API keys and storage credentials have not been altered.

How a cybersecurity team like ALMC can help

For a small business in Barcelona, Lleida, Tarragona or Girona, keeping track of this kind of advisory across WordPress, PrestaShop or Joomla is a full-time job that nobody has time for. This is where an external security team earns its keep: auditing the site and its server to find exposed components and misconfigurations, running pentesting to confirm what is actually reachable from outside, and hardening servers so that a single bad file path cannot become a full takeover.

When something has already gone wrong, the priority is response: containing the incident, cleaning an already hacked site and restoring service without losing data. ALMC also handles ongoing maintenance and updating of WordPress, PrestaShop and Joomla installations, so that patches for flaws like CVE-2026-126537 land on time, and continuous monitoring to catch unusual activity before it turns into a headline. All of this sits alongside GDPR obligations, since a compromised site that leaks customer data brings reporting duties and reputational damage that are far more expensive than prevention.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.