CVE-2026-126537
The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in…
- CVSS
- 9.1 Critical
- EPSS
- 0.9%
- Percentile
- 61
- Published
- 2026-11-11
- Force
- 7 of 12
- Public PoC
- 1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H