Ninja Forms Uploads CVE-2026-57784

Exploitation requires a victim who is currently authenticated to the target WordPress site (typically an administrator or other privileged user with access to the File Uploads Extension functionality) to be tricked into interacting with attacker-controlled content - the CVSS UI:R flag confirms mandatory user interaction. The attacker needs no account of their own (PR:N) and acts remotely over the network (AV:N/AC:L), but cannot succeed against a logged-out user, and the forged action is bounded by the privileges of the deceived session. The site must be running the Ninja Forms File Uploads Extension at version 3.3.26 or earlier; sites without this specific paid extension are not affected. The practical limiting factor is the need to both social-engineer a privileged, logged-in user and have the vulnerable extension installed.

The signals are partly conflicting and warrant scrutiny. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) is unusually aggressive for a CSRF issue: it claims full confidentiality, integrity, and availability impact plus a scope change, whereas most CSRF flaws deliver an integrity-only impact bounded by the privileges of the tricked user. UI:R is consistent with CSRF (the victim must be induced to trigger the request), and PR:N correctly reflects that the attacker themselves need no account. However, no EPSS score was provided, the vulnerability is not in CISA KEV (no confirmed active exploitation), and no public exploit was identified at time of analysis - so real-world exploitation pressure is currently low despite the critical rating. In practice, exploitability hinges on tricking a logged-in privileged user (e.g., an admin) into visiting a malicious page, which is a meaningful limiting factor. Treat this as a genuine high-priority patch item for sites running the extension, but note the C:H/I:H/A:H/S:C impact claim should be verified against the actual endpoint behavior, as it may overstate real impact.

An attacker crafts a malicious web page or email containing a hidden auto-submitting form (or image tag) targeting the extension's state-changing endpoint on a victim WordPress site. When a logged-in administrator is lured into viewing that content, their browser silently submits the forged request with valid session cookies, causing the site to perform the attacker's action (e.g., an unauthorized file upload or setting change). No public exploit was identified at time of analysis, and success depends on the victim being authenticated and taking the bait (UI:R).