50,000 WordPress Sites affected by Arbitrary File Upload Vulnerability in Ninja Forms - File Upload WordPress Plugin

The blog post from Wordfence discusses a critical vulnerability in the Ninja Forms – File Upload WordPress plugin, which affects over 50,000 sites. Here are the key points:

• Vulnerability Details:

  • An arbitrary file upload vulnerability allows unauthenticated attackers to upload malicious PHP files.
  • This can lead to full site compromise through techniques like webshells.

• Affected Versions:

  • All versions up to and including 3.3.26 are vulnerable.

• Impact:

  • Over 50,000 WordPress sites use this plugin.
  • The vulnerability is rated as critical due to the ease of exploitation and potential for full site compromise.

• Timeline:

  • January 8, 2026: Vulnerability reported through Wordfence Bug Bounty Program.
  • February 10, 2026: Partially patched version (3.3.25) released.
  • March 19, 2026: Fully patched version (3.3.27) released.

• Recommendations:

  • Update to the latest version of Ninja Forms – File Upload as soon as possible

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.