Threat reportVulnerabilityTL-2026-3781
CVE-2026-0740 - Unauthenticated Arbitrary File Upload to RCE in Ninja Forms File Uploads WordPress Extension
CVE-2026-0740 (TL-2026-3781) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-16. It has no confirmed attribution, affects Saturday Drive (Ninja Forms) Ninja Forms - File Uploads (WordPress, references 1 CVE (CVE-2026-0740), maps to 6 MITRE ATT&CK techniques (T1036.008, T1059, T1059.004), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3781
- Threat ID
- TL-2026-3781
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, education, nonprofit, retail, professional-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in CVE-2026-0740
Malware and tooling: PHP, Exploit-DB EDB-52560 PoC
How CVE-2026-0740 works
The premium Ninja Forms File Uploads extension for WordPress (versions up to and including 3.3.26, roughly 50,000 installs) lets unauthenticated attackers write arbitrary files, including PHP web shells, to the server, leading to remote code execution. A public PoC has been available since 2026-04-09, exploitation in the wild is reported by Wordfence-sourced coverage, and the complete fix is version 3.3.27.
CVE-2026-0740 (CWE-434, CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N) affects the Ninja Forms - File Uploads extension by Saturday Drive. The flaw is in NF_FU_AJAX_Controllers_Uploads::handle_upload, reached via the unauthenticated WordPress AJAX endpoint /wp-admin/admin-ajax.php?action=nf_fu_upload. The handler validates the file type of the source filename but does not validate the destination filename used in the file move operation, so an attacker can manipulate the destination path and bypass the extension allowlist to land a .php file (web shell) on the server.
The public Exploit-DB PoC (EDB-52560, published 2026-04-09 by Selim Lanouar, tested against 3.3.24) uses two AJAX actions. First it calls nf_fu_get_new_nonce with a random 16-digit field_id to obtain a nonce. Then it posts to nf_fu_upload with nonce, form_id, field_id and an image_jpg parameter containing path traversal (../../../webshell.php). The file is submitted as files-[field_id] with a spoofed JPEG MIME type. The shell lands in wp-content/ and is driven with a GET parameter such as ?cmd=id. Exploitation requires a public page with a Ninja Forms form that has an upload field, and it is easiest where local server storage is used and PHP execution is permitted under wp-content.
Fix timeline: 3.3.25 (2026-02-10) was a partial fix; 3.3.27 (2026-03-19) fully resolves the flaw. NVD published the CVE on 2026-04-07. Secondary coverage (Penligent) attributes to Wordfence reports of PHP and .htaccess upload attempts, mass exploitation from 2026-04-09 to 04-13, and more than 118,600 blocked attempts by 2026-04-16. The UofT security bulletin states no confirmed widespread exploitation at the time of its writing, and the primary Wordfence advisory page could not be retrieved. Treat the volume figures as unverified. The Cronup article (2026-10-16) that triggered this entry repeats that exploitation is occurring in the wild. No attacker IPs, domains, payload hashes or named threat actors have been published in any source reviewed. Post-exploitation impact is arbitrary command execution as the web server user, data exfiltration and pivoting inside the hosting environment.
MITRE ATT&CK techniques used in TL-2026-3781
Defense Evasion
T1036.008 Masquerade File Type
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Initial Access
T1190 Exploit Public-Facing Application
Persistence
Reconnaissance
Affected products and versions in CVE-2026-0740
- Saturday Drive (Ninja Forms) — Ninja Forms - File Uploads (WordPress premium extension)
Vulnerable versions: <= 3.3.26
Fixed in: 3.3.27
Remediation for CVE-2026-0740
Patches
- Ninja Forms - File Uploads 3.3.27 (released 2026-03-19); 3.3.25 was only a partial fix
Immediate actions
- Update Ninja Forms - File Uploads to 3.3.27 or later
- Disable PHP execution in wp-content/uploads and wp-content via .htaccess or web server configuration
- Temporarily deactivate the extension or restrict exposed upload forms if patching cannot be done at once
- Preserve web and access logs for the exposure window (2026-04-06 onward)
- Search for new or modified .php, .phtml, .phar and .htaccess files under wp-content and escalate to incident response if a web shell is found
Workarounds
- Deploy a WAF rule that blocks admin-ajax.php requests with action=nf_fu_upload carrying path traversal or executable extensions (Wordfence rule available; free tier gets it after a 30-day delay)
- Restrict or disable file upload fields on public forms
Longer-term hardening
- Maintain an inventory of premium WordPress extensions, which do not update through wordpress.org and are easy to miss
- Run file integrity monitoring on the WordPress web root
- Run the web server with least privilege and block outbound connections that are not needed
CVEs associated with CVE-2026-0740
Weaknesses (CWE) in CVE-2026-0740
Timeline of CVE-2026-0740
- Ninja Forms File Uploads 3.3.25 released with a partial fix for the upload validation flaw.
- Version 3.3.27 released, fully fixing destination-filename validation in NF_FU_AJAX_Controllers_Uploads::handle_upload.
- Public disclosure via Wordfence Threat Intelligence; secondary reporting says exploitation attempts began immediately.
- CVE-2026-0740 published in NVD with CVSS 3.1 score 9.8 (CWE-434); CyCognito publishes analysis.
- Exploit-DB 52560 publishes a working unauthenticated PHP upload PoC (tested on 3.3.24), using nf_fu_get_new_nonce and nf_fu_upload with path traversal.
- Penligent reports mass exploitation observed between 2026-04-09 and 2026-04-13, attributed to Wordfence data (not independently verified).
- Penligent reports Wordfence had blocked more than 118,600 exploit attempts by this date (secondary source, unverified).
- University of Toronto security bulletin published, noting public PoCs and about 50,000 affected sites.
- Cronup article reiterates that CVE-2026-0740 is being exploited in the wild and urges updating to 3.3.27.
Sources cited for CVE-2026-0740
- NVD - CVE-2026-0740
- Wordfence Threat Intel - Ninja Forms File Uploads vulnerability
- Ninja Forms File Uploads extension
- Exploit-DB 52560 - Ninja Forms Uploads Unauthenticated PHP File Upload
- CyCognito - CVE-2026-0740 Ninja Forms File Upload Unauthenticated RCE
- University of Toronto Information Security - Ninja Forms file uploads unauthenticated remote code execution
- Penligent - CVE-2026-0740 technical analysis
- GCVE - CVE-2026-0740
- Cronup - Tu WordPress en la mira
Detection coverage for TL-2026-3781
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3781 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.