CVE-2026-92820 in Ninja Forms Plugin
Summary
by MITRE • 10/02/2026
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file_path, which is then used without validation to attach a file to the form's notification email (arbitrary file read), to write fetched content (arbitrary file write, leading to remote code execution when the external store is configured), and in a scheduled deletion (arbitrary file deletion). This makes it possible for unauthenticated attackers to read, write, or delete arbitrary files on the server. Exploitation requires the site to use the plugin's External File Upload (Amazon S3) action; the read variant additionally requires a form Email action configured to attach the uploaded file.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The Ninja Forms - File Uploads plugin for WordPress, specifically in versions up through 3.3.34, contains critical security vulnerabilities stemming from insufficient input validation within its external Amazon S3 upload integration flow. The core technical flaw lies in the application's trust of an attacker-supplied file path provided during form submission. Instead of sanitizing or validating this user-controlled data before use, the plugin directly stores it as the internal variable representing the file_path. This lack of rigorous input validation creates a pathway for multiple severe security issues, including arbitrary file read, arbitrary file write, and arbitrary file deletion operations on the underlying server infrastructure. The vulnerability is particularly dangerous because it allows unauthenticated attackers to interact with sensitive system resources without requiring valid credentials or prior authentication sessions.
The operational impact of this flaw manifests in three distinct attack vectors depending on how the plugin's features are configured by the site administrator. First, if the form includes an Email action designed to attach uploaded files to notification messages, the application utilizes the unsanitized file_path variable when attempting to locate and attach the document. Because there is no validation of this path, attackers can manipulate it to point to sensitive system files such as configuration files containing database credentials or source code, resulting in arbitrary file read vulnerabilities that facilitate information disclosure. Second, if the site has configured an external storage backend like Amazon S3 for file uploads, the plugin may attempt to fetch content from the specified location and write it back locally. An attacker can exploit this by supplying a crafted path that targets sensitive files or executable scripts, leading to arbitrary file write conditions. When combined with web server configurations that allow execution of uploaded scripts, this vector directly enables remote code execution on the target system. Third, the plugin employs scheduled tasks for cleaning up old uploads, which also relies on the same unsanitized file_path variable. Attackers can leverage this mechanism to trigger arbitrary file deletion operations, potentially causing denial of service by removing critical application files or logs that are necessary for forensic analysis and operational continuity.
From a classification perspective, these vulnerabilities align with CWE-20 Improper Input Validation as the root cause, where user-supplied data is accepted without adequate checks against expected formats or safe values. The arbitrary file read aspect corresponds to CWE-284 Improper Access Control, while the write and delete capabilities map to CWE-73 External Control of File Name or Path and CWE-610 Externally Controlled Reference to a Resource in Another Domain respectively. In terms of offensive security frameworks such as MITRE ATT&CK, these flaws support techniques related to Data from Local System (T1083) for file reading, Command and Scripting Interpreter via Web Shell Upload (T1505.003) if remote code execution is achieved through the write vector, and Impact on Resource Availability (T1485) or Destruction of Software/Infrastructure (T1492/T1499) for file deletion scenarios.
Exploitation of these vulnerabilities requires specific environmental conditions beyond just having the vulnerable plugin installed. The site must have the External File Upload action configured to utilize Amazon S3 storage, which is a prerequisite for both the arbitrary write and delete vectors. For the arbitrary read vector specifically, an Email action that attaches uploaded files to notifications must also be present in the form configuration. Despite these prerequisites, the lack of authentication requirements means any internet user can attempt exploitation by submitting maliciously crafted forms. Mitigation strategies should prioritize immediate upgrading to a patched version of the Ninja Forms plugin where input validation has been implemented for file paths used in external storage and notification contexts. In environments where updating is not immediately feasible, administrators should consider disabling the Amazon S3 integration feature or removing Email actions that attach files until patches are applied. Additionally, implementing strict web application firewall rules to block suspicious file path patterns in form submissions can provide a temporary layer of defense against exploitation attempts targeting these specific input validation failures.