Critical Ninja Forms Plugin Flaw Exposes 50,000 WordPress Sites to Takeover A severe security vulnerability in the Ninja Forms – File Upload WordPress plugin (CVE-2026-0740) has left approximately 50,000 websites at risk of complete compromise. The flaw, rated 9.8 on the CVSS scale, was discovered by security researcher Sélim Lanouar, who earned a $2,145 bug bounty for the report. The vulnerability is classified as an unauthenticated arbitrary file upload, allowing attackers to upload malicious files to vulnerable sites without requiring credentials. Exploitation could lead to remote code execution (RCE), giving threat actors full control over the affected web server. From there, attackers could steal sensitive data, inject malware, redirect visitors to malicious sites, or use the server as a launchpad for further attacks. The issue stems from a flaw in the plugin’s `handle_upload()` function, which processes file submissions. While the plugin attempts to verify file types, it fails to properly sanitize filenames or validate extensions during the `move_uploaded_file()` operation. This oversight enables path traversal attacks, allowing attackers to upload malicious `.php` files such as webshells directly into a site’s root directory, bypassing security checks. The vulnerability affects all versions of the Ninja Forms File Upload plugin up to 3.3.26. Wordfence deployed firewall protections for premium users on January 8, 2026, extending coverage to free users by February 7. The developers released a partial fix in version 3.3.25 and a complete patch in version 3.3.27 on March 19, 2026. Due to the flaw’s ease of exploitation requiring no authentication unpatched sites remain prime targets for automated scanning tools. Administrators are urged to update to the latest version immediately to mitigate risk.