What is the CVSS score of CVE-2026-13369?

CVE-2026-13369 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Ninja Forms File Uploads are affected by CVE-2026-13369?

The Ninja Forms File Uploads WordPress plugin (versions ≤ 3.3.29) allows unauthenticated attackers to read and download any file accessible to the web server, exposing sensitive data such as database…

How to fix or mitigate CVE-2026-13369?

Within 24 hours: Identify all WordPress sites running Ninja Forms version ≤ 3.3.29 and immediately deactivate the plugin; review web server access logs for suspicious file requests targeting the plugin. Within 7 days: Monitor vendor communications for availability of a patched version; test patched version in non-production environment if released. Within 30 days: Deploy patched version (or uninstall plugin permanently if an alternative solution is implemented); verify all affected installations are remediated.

Ninja Forms File Uploads CVE-2026-13369

EUVD-2026-41275 HIGH

Path Traversal (CWE-22)

2026-07-02 Wordfence

GHSA-2298-wc49-vm4h

WordPress Path Traversal Ninja Forms File Uploads Wordpress Plugin Saturdaydrive

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network request with no interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file read yields high confidentiality only, with no integrity or availability impact (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:16 vuln.today

CVE Published

Jul 02, 2026 - 09:32 cve.org

HIGH 7.5

DescriptionCVE.org

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.

AnalysisAI

Arbitrary file read in the Ninja Forms - File Uploads WordPress add-on (versions ≤ 3.3.29) lets unauthenticated remote attackers exfiltrate any file readable by the web server. A client-supplied saveProgress flag causes the process() method to return early, so a raw attacker-controlled 'files' array reaches attach_files() and get_files_for_attachment() without upload validation, path normalization, or database record creation - an attacker-chosen file_path is then passed to wp_mail() as an email attachment guarded only by a file_exists() check. No public exploit has been identified at time of analysis; there is no CISA KEV listing and no EPSS score was supplied.

Technical ContextAI

The affected component is the file-attachment integration between the Ninja Forms - File Uploads add-on and WordPress core's mail subsystem (wp_mail). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): normally uploaded files are validated, path-normalized, and persisted as database records before being attached, but a client-supplied saveProgress flag short-circuits process() so those controls never run. get_files_for_attachment() (attachments.php ~L107/L196) then trusts the client 'files' array verbatim, and upload.php (~L71) forwards the attacker-supplied file_path to wp_mail() with only a file_exists() existence check - no confinement to the uploads directory - letting traversal sequences reference files anywhere on the filesystem. The CPE cpe:2.3:a:saturdaydrive:ninja_forms_-_file_uploads identifies the SaturdayDrive-published add-on as the exact affected product.

RemediationAI

No vendor-released patch version was identified in the supplied data - the input confirms only that versions up to and including 3.3.29 are vulnerable, so administrators should consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/87d4dd4a-b1e2-4d08-aef1-77e58aa7531d?source=cve) and the plugin changelog for a fixed release above 3.3.29 and upgrade once it is published. Until a patched version is confirmed, the most effective compensating control is to deactivate the Ninja Forms - File Uploads add-on (side effect: file-upload form fields stop working); if that is unacceptable, remove or disable forms that use the file-upload field and, at the WAF layer, block Ninja Forms AJAX submission requests carrying the saveProgress flag together with a client-supplied 'files'/file_path parameter (side effect: may break legitimate multi-step 'save progress' submissions). As defense in depth, tighten PHP open_basedir and web-server file permissions so the server user cannot read sensitive paths such as wp-config.php outside the webroot, though this narrows rather than fully closes the read primitive.