What is the CVSS score of CVE-2026-12557?

CVE-2026-12557 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Ninja Forms File Uploads CVE-2026-12557

EUVD-2026-41484 MEDIUM

Missing Authorization (CWE-862)

2026-07-03 Wordfence

GHSA-p624-2chq-cjc7

WordPress Authentication Bypass Ninja Forms File Uploads Wordpress Plugin Saturdaydrive

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

7.3 HIGH

C:L added for debug log read exposure; A:L added for permanent deletion of all log table rows; PR:N confirmed by unauthenticated nature of bypass.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 05:46 vuln.today

CVE Published

Jul 03, 2026 - 04:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read all plugin debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table.

AnalysisAI

Authorization bypass in the Ninja Forms - File Uploads WordPress plugin (all versions through 3.3.29) allows unauthenticated remote attackers to read all plugin debug log entries stored in the wp_nf3_log database table or permanently delete every row from that table. The flaw originates from the plugin's failure to verify whether a requesting user holds any authorization before processing debug log actions, as confirmed by Wordfence with a direct reference to the vulnerable DebugLog.php route. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is a WordPress plugin extension by Saturday Drive, identified by CPE cpe:2.3:a:saturdaydrive:ninja_forms_-_file_uploads:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): the plugin exposes REST or AJAX routes in DebugLog.php (line 88) that handle read and delete operations against the wp_nf3_log database table without performing any capability or nonce check to confirm the requesting user is permitted to perform those actions. This is a classic WordPress plugin authorization bypass pattern where the action handler is registered but its permission callback is absent or non-enforcing, leaving the endpoint accessible to any HTTP client regardless of authentication state.

RemediationAI

Site operators should update the Ninja Forms - File Uploads plugin to a version beyond 3.3.29 as soon as one is available from the WordPress plugin repository; a specific patched release version was not independently confirmed in the available data, so administrators should check the plugin's changelog at https://wordpress.org/plugins/ninja-forms-uploads/#developers for a released fix. While awaiting a patch, a compensating control is to disable the plugin entirely if debug logging is not required for active troubleshooting, eliminating exposure to the vulnerable endpoint. Alternatively, a WAF rule blocking unauthenticated requests to the plugin's debug log REST or AJAX route (referencing the DebugLog.php endpoint) can prevent exploitation without disabling the plugin - this may temporarily suppress debug data collection. Restricting wp-admin and REST API access by IP at the web server or firewall level is an additional layer but carries significant usability trade-offs for distributed teams. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1a54f8cc-cadb-4496-bcc4-ef8387b72300 should be monitored for patch version confirmation.