CVE-2026-0740: falha crítica em SaturdayDrive Ninja Forms - File Uploads
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
Publicada em · Atualizada em
99Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.8epss 63%
da publicação à arma0 dias
Publicada no NVD7 de abr.
1ª PoC7 de abr.
VulnCheck6 de abr.
probabilidade de exploração
63%top 1% das CVEs
exploração observada
simVulnCheck
18 exploit(s) público(s)
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
SaturdayDrive · Ninja Forms - File UploadsPoCs públicas encontradas — 18
exploitdbwww.exploit-db.com/exploits/52560não verificadogithubgithub.com/0xgh057r3c0n/CVE-2026-0740★ 24githubgithub.com/xShadow-Here/CVE-2026-0740★ 3githubgithub.com/MadExploits/ninja-form-exploit★ 3githubgithub.com/whattheslime/CVE-2026-0740★ 2githubgithub.com/ExDev994/CVE-2026-0740-mass★ 1githubgithub.com/murrez/CVE-2026-0740★ 1githubgithub.com/llaytynher/CVE-2026-0740-upload-template★ 0githubgithub.com/a24ac1/CVE-2026-0740★ 0githubgithub.com/BastianXploited/CVE-2026-0740-mass★ 0vulncheckvulncheck.com/xdb/76bab0bbd01anão verificadovulncheckvulncheck.com/xdb/2603591d1974não verificadovulncheckvulncheck.com/xdb/b85dfc2ab28anão verificadovulncheckvulncheck.com/xdb/16915ca512efnão verificadovulncheckvulncheck.com/xdb/fb44963cafe3não verificadovulncheckvulncheck.com/xdb/0dfba5443a8anão verificadovulncheckvulncheck.com/xdb/16e211649e58não verificadovulncheckvulncheck.com/xdb/8b7b147f29bdnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — SaturdayDrive Ninja Forms - File Uploads
No mesmo produto, das mais perigosas para as menos.
CVE-2022-0888CRITICALNinja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File UploadEPSS 39.4%CVE-2022-0889HIGHNinja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2026-13369HIGHNinja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' ParameterEPSS 0.6%CVE-2026-92820HIGHNinja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File UploadEPSS 0.5%CVE-2024-1596HIGHNinja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File UploadEPSS 0.4%CVE-2026-12557MEDIUMNinja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST EndpointsEPSS 0.4%