Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
99Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 63%
de la publicación al arma0 días
Publicada en NVD7 abr
1ª PoC7 abr
VulnCheck6 abr
probabilidad de explotación
63%top 1% de las CVE
explotación observada
síVulnCheck
15 exploit(s) público(s)
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
SaturdayDrive · Ninja Forms - File UploadsPoCs públicas encontradas — 15
exploitdbwww.exploit-db.com/exploits/52560no verificadogithubgithub.com/0xgh057r3c0n/CVE-2026-0740★ 23githubgithub.com/MadExploits/ninja-form-exploit★ 3githubgithub.com/whattheslime/CVE-2026-0740★ 1githubgithub.com/ExDev994/CVE-2026-0740-mass★ 1githubgithub.com/a24ac1/CVE-2026-0740★ 0githubgithub.com/BastianXploited/CVE-2026-0740-mass★ 0vulncheckvulncheck.com/xdb/8b7b147f29bdno verificadovulncheckvulncheck.com/xdb/76bab0bbd01ano verificadovulncheckvulncheck.com/xdb/2603591d1974no verificadovulncheckvulncheck.com/xdb/b85dfc2ab28ano verificadovulncheckvulncheck.com/xdb/16915ca512efno verificadovulncheckvulncheck.com/xdb/fb44963cafe3no verificadovulncheckvulncheck.com/xdb/0dfba5443a8ano verificadovulncheckvulncheck.com/xdb/16e211649e58no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.