Exploited vulnerability

CVE-2026-13369

TLP:CLEAR

ninjaforms ninja_forms_file_uploads Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.

Facts

Vendor: ninjaforms
Product: ninja_forms_file_uploads
EPSS (probability of exploitation within 30 days): 0.6 %
First known exploitation: 13 October 2026
First seen by Risk Letters: 13 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD