What is the CVSS score of CVE-2026-57784?

CVE-2026-57784 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ninja Forms Uploads are affected by CVE-2026-57784?

A critical CSRF vulnerability in Ninja Forms File Uploads Extension (v3.3.26 and earlier) allows unauthenticated attackers to trick WordPress users into uploading malicious files or changing plugin…

How to fix or mitigate CVE-2026-57784?

Within 24 hours, disable or uninstall the Ninja Forms File Uploads Extension immediately if not essential to operations; if required, restrict upload access to administrator role only and implement server-level file-type validation to block executable files. Within 7 days, audit file uploads and plugin configuration changes from the past 30 days for unauthorized activity, and request a security update timeline from Patchstack. Within 30 days, migrate to version 3.3.27 or later once released, or replace with an alternative form plugin that has undergone recent security review.

Ninja Forms Uploads CVE-2026-57784

EUVD-2026-48181 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-vqq2-95gx-pw9q

CSRF Ninja Forms File Uploads Extension

9.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

CSRF needs no attacker auth (PR:N) but requires a logged-in victim to act (UI:R); impact is integrity-focused (unauthorized upload/change), with no inherent confidentiality or availability loss and no proven scope change, so I lower C/A and S versus the source.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:23 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

AnalysisAI

Cross-Site Request Forgery in the Ninja Forms File Uploads Extension for WordPress (versions 3.3.26 and earlier) lets a remote, unauthenticated attacker forge state-changing requests that are executed with a victim's session when the victim is lured into interacting with attacker-controlled content. Reported by Patchstack and rated CVSS 9.6 with a scope-changed, high-impact vector, the flaw carries no public exploit identified at time of analysis and is not listed in CISA KEV. Because it is a file-upload add-on, a successful forgery could result in unauthorized file uploads or configuration changes on the WordPress site.

Technical ContextAI

The affected component is the Ninja Forms File Uploads Extension, a commercial add-on to the widely used Ninja Forms WordPress form-builder plugin that adds file-attachment capabilities to forms. The root cause is CWE-352 (Cross-Site Request Forgery): one or more state-changing endpoints in the extension accept requests without validating an anti-CSRF nonce or equivalent origin token, so the WordPress-authenticated browser of a victim can be coerced into submitting a request the attacker composed. In WordPress, this is normally mitigated by wp_nonce fields and check_admin_referer()/wp_verify_nonce() validation; the absence or improper verification of that token is what makes the action forgeable. The CPE cpe:2.3:a:ninja_forms:ninja_forms_file_uploads_extension:*:*:*:*:*:*:*:* identifies the extension itself (all versions up to and including 3.3.26) rather than the Ninja Forms core plugin.

RemediationAI

Upgrade the Ninja Forms File Uploads Extension to a release later than 3.3.26 once the vendor publishes a fixed build; a specific patched version number was not provided in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ninja-forms-uploads/vulnerability/wordpress-ninja-forms-file-uploads-extension-plugin-3-3-26-cross-site-request-forgery-csrf-vulnerability) and the Saturday Drive account dashboard for the current release. Until a patch is applied, reduce exposure by having administrators avoid clicking untrusted links while logged into WordPress, ending admin sessions promptly (short cookie lifetime / log out when idle), and deploying a WordPress-aware WAF or Patchstack's virtual patching to block forged requests to the extension's endpoints - the trade-off is that aggressive request filtering can break legitimate form submissions and should be tuned. Where the file-upload functionality is not actively needed, temporarily deactivating the extension eliminates the attack surface at the cost of disabling file attachments on forms.