CVE-2026-0740

CVE-2026-0740 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the Ninja Forms - File Uploads plugin for WordPress, affecting all versions up to and including 3.3.26. It is caused by missing file type validation in the NF_FU_AJAX_Controllers_Uploads::handle_upload function, so anyone can send a crafted request to the plugin's upload AJAX endpoint with no account, no privileges, and no user interaction. Because uploaded file types are not validated, an attacker can plant arbitrary files, such as PHP scripts, on the web server, which may enable remote code execution and full compromise of the site. Any WordPress site running the File Uploads add-on for Ninja Forms at version 3.3.26 or earlier is exposed, especially sites that accept front-end uploads from visitors. The flaw was partially patched in 3.3.25 and fully fixed in 3.3.27; no public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 62.9% EPSS score (99th percentile) signals a high likelihood of exploitation within 30 days.

What to do: Update the Ninja Forms - File Uploads add-on to version 3.3.27 or later, since 3.3.25-3.3.26 contain only a partial fix. Until patched, restrict or disable unauthenticated front-end uploads and block unauthenticated requests to the plugin's upload AJAX endpoint via WAF rules. Audit the uploads directories for unexpected PHP files or webshells, as arbitrary uploads may have enabled code execution.