CVE-2026-0740: fallo crítico en SaturdayDrive Ninja Forms - File Uploads
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
Publicada el · Actualizada el
99Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 63%
de la publicación al arma0 días
Publicada en NVD7 abr
1ª PoC7 abr
VulnCheck6 abr
probabilidad de explotación
63%top 1% de las CVE
explotación observada
síVulnCheck
18 exploit(s) público(s)
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
SaturdayDrive · Ninja Forms - File UploadsPoCs públicas encontradas — 18
exploitdbwww.exploit-db.com/exploits/52560no verificadogithubgithub.com/0xgh057r3c0n/CVE-2026-0740★ 24githubgithub.com/xShadow-Here/CVE-2026-0740★ 3githubgithub.com/MadExploits/ninja-form-exploit★ 3githubgithub.com/whattheslime/CVE-2026-0740★ 2githubgithub.com/ExDev994/CVE-2026-0740-mass★ 1githubgithub.com/murrez/CVE-2026-0740★ 1githubgithub.com/llaytynher/CVE-2026-0740-upload-template★ 0githubgithub.com/a24ac1/CVE-2026-0740★ 0githubgithub.com/BastianXploited/CVE-2026-0740-mass★ 0vulncheckvulncheck.com/xdb/76bab0bbd01ano verificadovulncheckvulncheck.com/xdb/2603591d1974no verificadovulncheckvulncheck.com/xdb/b85dfc2ab28ano verificadovulncheckvulncheck.com/xdb/16915ca512efno verificadovulncheckvulncheck.com/xdb/fb44963cafe3no verificadovulncheckvulncheck.com/xdb/0dfba5443a8ano verificadovulncheckvulncheck.com/xdb/16e211649e58no verificadovulncheckvulncheck.com/xdb/8b7b147f29bdno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — SaturdayDrive Ninja Forms - File Uploads
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-0888CRITICALNinja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File UploadEPSS 39.4%CVE-2022-0889HIGHNinja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2026-13369HIGHNinja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' ParameterEPSS 0.6%CVE-2026-92820HIGHNinja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File UploadEPSS 0.5%CVE-2024-1596HIGHNinja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File UploadEPSS 0.4%CVE-2026-12557MEDIUMNinja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST EndpointsEPSS 0.4%