CVE-2026-0740
Published: 07 April 2026
Summary
CVE-2026-0740 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Ninjaforms (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the NF_FU_AJAX_Controllers_Uploads::handle_upload function. This affects all versions up to and including 3.3.26 and carries a CVSS 3.1 score of 9.8 under CWE-434. The issue was partially addressed in 3.3.25 and fully resolved in 3.3.27.
Unauthenticated attackers can exploit the flaw over the network without any user interaction to upload arbitrary files to the server, which may enable remote code execution on the affected WordPress site.
The plugin vendor and Wordfence advisories indicate that updating to version 3.3.27 eliminates the vulnerability, with the partial fix in 3.3.25 addressing some but not all of the exposure.
The EPSS score rose from a low baseline to a peak of 0.2423 before settling at the current value of 0.1741, signaling that exploitation interest emerged after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19572
Vulnerability details
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers…
more
to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary unauthenticated file upload in public-facing WordPress plugin directly enables remote exploitation (T1190) and web shell deployment for RCE (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of file-type and content on all inputs, blocking the missing validation in NF_FU_AJAX_Controllers_Uploads::handle_upload.
Enforces access-control policy on the upload endpoint so unauthenticated attackers cannot invoke the vulnerable handler.
Restricts allowed file types and upload functionality to the minimum needed, limiting the attack surface that the plugin exposes.