Ninja Forms File Uploads Extension <= 3.0.22 Unauthenticated Arbitrary File Upload (CVE-2019-10869)

Vulnerability Overview Vulnerability Name: Ninja Forms File Uploads Extension <= 3.0.22 - Unauthenticated Arbitrary File Upload Description: A WordPress plugin for Ninja Forms contains an unauthenticated arbitrary file upload vulnerability. CVE ID: CVE-2019-10869 Impact Scope Affected Plugin: ninja-forms-uploads Fixed Version: 3.0.23 Remediation Recommendation: Upgrade to version 3.0.23 or later to fix this vulnerability. Additional Information Original Researcher: Jasper Welts, Onvio Submitter: Ryan Dewhurst Submitter Website: https://wpscan.io Submitter Twitter: ethicalhack3r WPVDB ID: e5898e0e-db43-4641-b2cd-f6a72cdb8993 Publication Date: 2019-04-11 Add Date: 2019-05-10 Last Updated: 2020-09-22 References CVE-2019-10869 Ninja Forms File Uploads Extension Timeline Public Disclosure: 2019-04-11 Added: 2019-05-10 Last Update: 2020-09-22 Other Related Vulnerabilities Complete Gallery Manager 3.3.3 - Arbitrary File Upload (2014-08-01) Reganto - Remote File Upload (2014-08-01) School Management <= 1.93.1 (02-07-2025) - Authenticated (Student+) Arbitrary File Upload (2025-08-12) Doccure < 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload (2025-09-08) Z-Downloads < 1.11.4 - Authenticated (Admin+) Arbitrary File Upload (2024-05-10) Summary The Ninja Forms File Uploads Extension plugin versions 3.0.22 and below are vulnerable to an unauthenticated arbitrary file upload. Users are advised to upgrade to version 3.0.23 or later as soon as possible to remediate this security issue.

Goal Reached Thanks to every supporter — we hit 100%!

Ninja Forms File Uploads Extension <= 3.0.22 Unauthenticated Arbitrary File Upload (CVE-2019-10869)

More from this source