What is the CVSS score of CVE-2026-15160?

CVE-2026-15160 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.5%.

Ninja Forms Excel Export CVE-2026-15160

EUVD-2026-45127 MEDIUM

Path Traversal (CWE-22)

2026-07-17 Wordfence

GHSA-j6r6-rp64-mqcr

WordPress Path Traversal Wordpress Plugin Ninja Forms Excel Export Saturdaydrive

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-exploitable with low privileges (subscriber); integrity is limited because only .xls/.xlsx extensions are writable, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 04:21 vuln.today

CVE Published

Jul 17, 2026 - 02:31 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.

AnalysisAI

Directory traversal in the Ninja Forms - Excel Export WordPress plugin (versions ≤ 3.3.6) allows authenticated attackers with subscriber-level access to write .xls/.xlsx files to arbitrary server-side locations via the unsanitized 'spreadsheet_export_tmp_name' parameter. The vulnerability is a staging primitive: direct code execution is not possible through the traversal alone, but file placement in web-accessible or sensitive directories can enable follow-on attacks such as information disclosure or overwriting existing files. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-22 (Path Traversal) arises when user-controlled input is used to construct a filesystem path without proper canonicalization or allowlist enforcement. In this plugin, the 'spreadsheet_export_tmp_name' parameter - processed through code in ExportFile.php (line 485) and ExtractPostData.php (line 125) - is passed to file-write logic without stripping dot-dot sequences, allowing an attacker to escape the intended temporary directory. The affected CPE is cpe:2.3:a:saturdaydrive:ninja_forms_-_excel_export:*:*:*:*:*:*:*:* covering all releases through 3.3.6. The plugin integrates with the Ninja Forms form builder for WordPress and extends it with spreadsheet export capability, inheriting WordPress's subscriber role as the minimum authenticated access level.

RemediationAI

Update the Ninja Forms - Excel Export plugin to a version beyond 3.3.6 as soon as one is available; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/24fb24cc-c29f-4d2d-87ba-5d211386e7dd for the confirmed fixed release version, which was not independently confirmed in the available input data. The WordPress plugin SVN trunk (https://plugins.trac.wordpress.org/browser/ninja-forms-excel-export/trunk/) contains updated code in ExportFile.php and ExtractPostData.php that may reflect the fix, but a tagged released version is not confirmed from the provided references. As a compensating control while patching is pending, restrict WordPress user registration to prevent unauthenticated individuals from obtaining subscriber accounts, which reduces the attacker pool to already-trusted users. Additionally, review server-side write permissions for the web process user and apply the principle of least privilege so the PHP process cannot write outside designated upload/temporary directories - this limits traversal impact even if exploitation occurs. Disabling the Excel export feature entirely via plugin deactivation is a zero-risk workaround if export functionality is not operationally required.