Ninja Forms File Uploads plugin vulnerable to CVSS 8.1 arbitrary file flaw

The Ninja Forms - File Uploads plugin for WordPress contains a high-severity vulnerability tracked as CVE-2026-92820 that affects all versions through 3.3.34.

The flaw stems from the plugin's external Amazon S3 upload flow. An attacker-controlled path supplied during form submission is stored unchecked as the upload's file_path value and later reused across several operations.

Unauthenticated attackers can exploit the issue to read arbitrary files when an Email action attaches the uploaded file. They can also write fetched content to arbitrary locations, which enables remote code execution on sites that have the External File Upload action configured, and delete arbitrary files through a scheduled deletion process.

Exploitation requires specific plugin features to be active. The Amazon S3 capability must be enabled for any attack path. The arbitrary file read variant further requires a form Email action set to attach the uploaded file.

The vulnerability carries a CVSS 3.1 base score of 8.1 and is classified as HIGH severity by NVD. The attack vector is listed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Wordfence and the NVD have published details on the issue. References point to the official Ninja Forms File Uploads extension page and a Wordfence threat intelligence entry for the vulnerability ID 6d5f0ec1-abcb-4aa2-a130-53682fa13f00.

The NVD entry and Wordfence advisory both list the same vulnerability identifier for cross-reference.