Ninja Forms - File Uploads: file deletion and read (CVE-2026-126537)
A vulnerability with a CVSS score of 9.1 was published for the Ninja Forms - File Uploads add-on for WordPress. An unauthenticated attacker can delete arbitrary files on the server and read files via S3, Dropbox or Google Drive upload.
Checked in Shield: no
Who is affected
WordPress sites running Ninja Forms - File Uploads version 3.3.36 or earlier. The cause is that a client-supplied file_path is not checked against the uploads directory. Deleting wp-config.php may lead to RCE.
How to check
In the WordPress admin open Plugins and find Ninja Forms - File Uploads, or run wp plugin list. Version 3.3.36 or lower is affected.
How to fix
The source does not name a fixed version. Watch for an add-on update and install it as soon as it is released. If you do not need the add-on, you can deactivate it.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
A fixed version and any exploitation details are not disclosed yet. Source: NVD, CVE-2026-126537.
