Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
99Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.8epss 63%
da publicação à arma0 dias
Publicada no NVD7 de abr.
1ª PoC7 de abr.
VulnCheck6 de abr.
probabilidade de exploração
63%top 1% das CVEs
exploração observada
simVulnCheck
14 exploit(s) público(s)
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
SaturdayDrive · Ninja Forms - File UploadsPoCs públicas encontradas — 14
exploitdbwww.exploit-db.com/exploits/52560não verificadogithubgithub.com/0xgh057r3c0n/CVE-2026-0740★ 23githubgithub.com/MadExploits/ninja-form-exploit★ 3githubgithub.com/whattheslime/CVE-2026-0740★ 1githubgithub.com/ExDev994/CVE-2026-0740-mass★ 1githubgithub.com/a24ac1/CVE-2026-0740★ 0githubgithub.com/BastianXploited/CVE-2026-0740-mass★ 0vulncheckvulncheck.com/xdb/76bab0bbd01anão verificadovulncheckvulncheck.com/xdb/2603591d1974não verificadovulncheckvulncheck.com/xdb/b85dfc2ab28anão verificadovulncheckvulncheck.com/xdb/16915ca512efnão verificadovulncheckvulncheck.com/xdb/fb44963cafe3não verificadovulncheckvulncheck.com/xdb/0dfba5443a8anão verificadovulncheckvulncheck.com/xdb/8b7b147f29bdnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.