External risk intelligence

Ninja Forms File Uploads Arbitrary File Deletion and Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-126537

The vulnerability affects a WordPress plugin designed to handle public file uploads. Because the exploit vector involves unauthenticated interaction with public-facing submission forms used on websites, the vulnerable code is directly reachable by any internet user visiting the site.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress add-on that allows users to upload files. This issue could potentially enable attackers to delete important files on the server, which might lead to a full takeover of the affected website.

Attackers can delete server files.
Site takeover is possible through file deletion.
Confirm if this plugin is in use.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by interacting with a public file upload form. By manipulating the submission process, an attacker can trick the plugin into deleting arbitrary files on the server, including critical configuration files like `wp-config.php`. This deletion can lead to a full site takeover by forcing the WordPress installation into its setup process.

Unauthenticated access to upload forms.
Submit form with crafted parameters.
Arbitrary file deletion leading to site takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to delete arbitrary files on a WordPress site. When supported by the advisory, this could lead to the deletion of critical configuration files, potentially enabling full site takeover.

Arbitrary file deletion on the server.
Attackers omit upload_id to manipulate file paths.
Deleting wp-config.php can lead to site takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, affecting a WordPress file upload plugin, is likely owned by the website's application owner or the platform team managing the WordPress instance. The immediate first step is to identify all instances of the affected plugin, confirm their accessibility from the internet, and assess their business criticality to prioritize remediation.

Application or platform team owns remediation.
Verify plugin presence and internet exposure.
Plan and execute vulnerability mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ninja Forms - File Uploads add-on?

This WordPress extension adds file upload capabilities to forms, allowing site visitors to submit documents, images, or other media directly through a website. It integrates with external storage services like S3, Dropbox, and Google Drive to manage these incoming files.

What does CWE-22 mean for CVE-2026-126537?

CWE-22 refers to Improper Limitation of a Pathname to a Restricted Directory, often called Path Traversal. In this vulnerability, the plugin fails to verify that file paths provided by a user stay within the intended upload folder. This allows an attacker to direct the system to access or delete sensitive files anywhere on the server's filesystem.

How can an attacker trigger this vulnerability?

An unauthenticated user triggers the flaw by submitting a crafted request to a public form while intentionally omitting the 'upload_id' parameter. This omission prevents the plugin from reloading its protective path settings, causing it to process the attacker's malicious file path instead. Legitimate, standard uploads that include the expected 'upload_id' do not trigger this error.

Is my site at risk if I use this plugin?

If your site uses this plugin, it is at risk because the vulnerability is reachable by anyone with internet access. Halo Surface Signal identifies this as a 'Very likely' risk because the affected code is part of public-facing forms, meaning an attacker does not need special credentials to reach the vulnerable functions.

How should I respond to this vulnerability?

Start by auditing your WordPress environment to locate all instances of the File Uploads add-on. Since this vulnerability can lead to full site takeover by removing critical configuration files, prioritize identifying which sites use this extension and plan to disable or update the plugin as soon as a fix is available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.