Ninja Forms Uploads EUVD-2026-91175

Exploitation requires the target site to have the plugin's External File Upload (Amazon S3) action configured and in use - this is the load-bearing prerequisite for the write/RCE and delete variants. The arbitrary file READ variant additionally requires a form Email (notification) action configured to attach the uploaded file. Within those configurations, exploitation is remote and unauthenticated (PR:N, UI:N) against the normal form-submission endpoint, with the attacker supplying a malicious file_path in the submission. The primary limiting factor - and the reason this is not a default-config mass-exploitation bug - is that sites not using the Amazon S3 external upload action are not exploitable via this path, which also accounts for the AC:H rating.

This is a genuine high-priority vulnerability, but one meaningfully gated by deployment conditions rather than a drop-everything internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) confirms a network-reachable, unauthenticated flaw with no user interaction, and full C:H/I:H/A:H impact consistent with CWE-434 arbitrary file write escalating to remote code execution. The deciding signal is AC:H, which reflects that exploitation is not against default installs - the site must specifically use the plugin's External File Upload (Amazon S3) action, and the arbitrary-read variant additionally needs an Email action configured to attach the uploaded file. No EPSS score, SSVC decision, or KEV/POC data was provided in this intelligence set, so exploitation likelihood cannot be quantified: exploitation status is 'no public exploit identified at time of analysis.' Note a potential tension worth flagging to defenders - the vendor/reporter (Wordfence) framing emphasizes unauthenticated RCE, yet the real-world attack surface is narrowed by the mandatory S3 configuration, so raw-CVSS triage overstates exposure for the majority of Ninja Forms File Uploads installs that do not use the external S3 store. Where S3 external storage IS configured, this should be treated as an urgent patch item given unauthenticated RCE.

An unauthenticated attacker submits a form on a WordPress site running Ninja Forms - File Uploads with the External (Amazon S3) upload action enabled, supplying a crafted file_path in the submission that the plugin trusts without validation. Because that path is reused to fetch and write content, the attacker writes a malicious PHP file into a web-accessible location and achieves remote code execution; if an Email action attaches the uploaded file, the same flaw instead reads arbitrary server files into the notification email. No public exploit code was identified at time of analysis, though the high attack complexity stems from the required S3 configuration rather than from technical difficulty of the request itself.