Ninja Forms CVE-2026-19769

Exploitation requires two simultaneous conditions: (1) Ninja Forms plugin version ≤3.15.1 is installed and active on the WordPress site, and (2) the Ninja Forms File Uploads add-on (a separately installed, paid extension) is also installed and active - without this add-on, the File Uploads handler code path does not exist and the vulnerability is unreachable. When both conditions are met, no authentication is required and no victim interaction is needed on the attacker's part; the attacker submits a crafted form entry via an unauthenticated AJAX request. Web server directory permissions must allow file writes to the target path (e.g., the WordPress site root), which is a standard default configuration for WordPress hosting environments. The attack is fully automatable: no account, session, or prior reconnaissance is needed beyond confirming the add-on is active.

The vendor-assigned CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) correctly reflects unauthenticated, low-complexity network exploitation but likely understates real-world impact: writing arbitrary JavaScript to the web root enables full session hijacking, credential harvesting, admin account compromise, and persistent backdoor placement - effects that substantially exceed the C:L/I:L ratings on the changed (victim browser) scope. The AC:L metric is defensible since the File Uploads add-on, while a prerequisite, is an environmental condition rather than an attacker-controlled variable; however, this add-on requirement is the primary real-world limiter - sites without it are entirely unaffected. No CISA KEV listing and no public exploit code have been identified, reducing urgency for the broader population of Ninja Forms users; sites with the File Uploads add-on active should treat this as high-priority given the automatable, unauthenticated attack path and the persistent file-write primitive it provides.

An unauthenticated attacker submits a crafted AJAX form payload to a WordPress site running Ninja Forms ≤3.15.1 with the File Uploads add-on active, embedding a Repeater child entry with an unrecognized 'type' value and attacker-controlled HTML/JavaScript as the field content. The type confusion routes the submission through the File Uploads handler, which writes a malicious HTML file (e.g., tracker.html) to the web root. Any user subsequently browsing to that URL - including administrators - executes the attacker's JavaScript in the context of the legitimate site origin, enabling session cookie theft or admin account hijacking without any further interaction required from the attacker.