# CVE-2026-0740 - Unauthenticated Arbitrary File Upload to RCE in Ninja Forms File Uploads WordPress Extension

> The premium Ninja Forms File Uploads extension for WordPress (versions up to and including 3.3.26, roughly 50,000 installs) lets unauthenticated attackers write arbitrary files, including PHP web shells, to the server, leading to remote code execution. A public PoC has been available since 2026-04-09, exploitation in the wild is reported by Wordfence-sourced coverage, and the complete fix is version 3.3.27.

- **Published:** 2026-10-16T22:00:10Z
- **Last reviewed:** 2026-10-16T22:00:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3781
- **ID:** TL-2026-3781
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0740

## Description

CVE-2026-0740 (CWE-434, CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N) affects the Ninja Forms - File Uploads extension by Saturday Drive. The flaw is in NF_FU_AJAX_Controllers_Uploads::handle_upload, reached via the unauthenticated WordPress AJAX endpoint /wp-admin/admin-ajax.php?action=nf_fu_upload. The handler validates the file type of the source filename but does not validate the destination filename used in the file move operation, so an attacker can manipulate the destination path and bypass the extension allowlist to land a .php file (web shell) on the server.

The public Exploit-DB PoC (EDB-52560, published 2026-04-09 by Selim Lanouar, tested against 3.3.24) uses two AJAX actions. First it calls nf_fu_get_new_nonce with a random 16-digit field_id to obtain a nonce. Then it posts to nf_fu_upload with nonce, form_id, field_id and an image_jpg parameter containing path traversal (../../../webshell.php). The file is submitted as files-[field_id] with a spoofed JPEG MIME type. The shell lands in wp-content/ and is driven with a GET parameter such as ?cmd=id. Exploitation requires a public page with a Ninja Forms form that has an upload field, and it is easiest where local server storage is used and PHP execution is permitted under wp-content.

Fix timeline: 3.3.25 (2026-02-10) was a partial fix; 3.3.27 (2026-03-19) fully resolves the flaw. NVD published the CVE on 2026-04-07. Secondary coverage (Penligent) attributes to Wordfence reports of PHP and .htaccess upload attempts, mass exploitation from 2026-04-09 to 04-13, and more than 118,600 blocked attempts by 2026-04-16. The UofT security bulletin states no confirmed widespread exploitation at the time of its writing, and the primary Wordfence advisory page could not be retrieved. Treat the volume figures as unverified. The Cronup article (2026-10-16) that triggered this entry repeats that exploitation is occurring in the wild. No attacker IPs, domains, payload hashes or named threat actors have been published in any source reviewed. Post-exploitation impact is arbitrary command execution as the web server user, data exfiltration and pivoting inside the hosting environment.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1036.008 Masquerade File Type

## Sources

- [NVD - CVE-2026-0740](https://nvd.nist.gov/vuln/detail/CVE-2026-0740)
- [Wordfence Threat Intel - Ninja Forms File Uploads vulnerability](https://www.wordfence.com/threat-intel/vulnerabilities/id/0b606ded-ab50-486a-9337-97ee9f452f12?source=cve)
- [Ninja Forms File Uploads extension](https://ninjaforms.com/extensions/file-uploads/)
- [Exploit-DB 52560 - Ninja Forms Uploads Unauthenticated PHP File Upload](https://www.exploit-db.com/exploits/52560)
- [CyCognito - CVE-2026-0740 Ninja Forms File Upload Unauthenticated RCE](https://www.cycognito.com/blog/?p=2413)
- [University of Toronto Information Security - Ninja Forms file uploads unauthenticated remote code execution](https://security.utoronto.ca/?p=15068)
- [Penligent - CVE-2026-0740 technical analysis](https://www.penligent.ai/hackinglabs/?p=6320)
- [GCVE - CVE-2026-0740](https://db.gcve.eu/vuln/cve-2026-0740)
- [Cronup - Tu WordPress en la mira](https://www.cronup.com/tu-wordpress-en-la-mira/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3781