Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92820— Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

Quick assessment

Affected
SaturdayDrive Ninja Forms - File Uploads
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Ninja Forms - File Uploads 插件在所有 3.3.34 及以下版本中存在任意文件操作漏洞，该漏洞可通过外部（Amazon S3）上传流程利用。该插件信任攻击者在表单提交中提供的文件路径，并将其存储为上传的 ，随后在未进行任何验证的情况下使用该路径：将其用于附加文件到表单的电子邮件通知中（导致任意文件读取）、写入获取到的内容（导致任意文件写入，在配置了外部存储时可能导致远程代码执行），以及用于计划删除操作（导致任意文件删除）。这使得未经身份验证的攻击者能够读取、写入或删

CVSS 8.1 · High EPSS 0.52% · P42

Affected Version Matrix 1

VendorProduct Version RangeStatus
SaturdayDrive Ninja Forms - File Uploads ≤ 3.3.34 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92820

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
Source: CVE Program / CVE List V5
Vulnerability Description
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file_path, which is then used without validation to attach a file to the form's notification email (arbitrary file read), to write fetched content (arbitrary file write, leading to remote code execution when the external store is configured), and in a scheduled deletion (arbitrary file deletion). This makes it possible for unauthenticated attackers to read, write, or delete arbitrary files on the server. Exploitation requires the site to use the plugin's External File Upload (Amazon S3) action; the read variant additionally requires a form Email action configured to attach the uploaded file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
SaturdayDrive Ninja Forms - File Uploads 0 ~ 3.3.34 -

II. Public POCs for CVE-2026-92820

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92820

请登录查看更多情报信息。

News Coverage for CVE-2026-92820 (1)

Vendor Pages for CVE-2026-92820 (1)

IV. Related Vulnerabilities

Same product: Ninja Forms - File Uploads
Same vendor: SaturdayDrive
Same weakness: CWE-434

V. Comments for CVE-2026-92820

No comments yet

Leave a comment