Back Cybersecuritynews

50,000 WordPress Sites Exposed to Critical Ninja Forms File Upload RCE Vulnerability

Cybersecuritynews •Abinaya • April 7, 2026

A critical security flaw in the popular WordPress plugin “Ninja Forms – File Upload” has left approximately 50,000 websites vulnerable to complete takeover. Tracked as CVE-2026-0740, this flaw boasts a maximum CVSS severity score of 9.8, making it a severe threat that requires immediate attention from website administrators. Discovered by security researcher Sélim Lanouar, who […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Ninja Forms Plugin Exposes 50,000 WordPress Sites to RCE A critical vulnerability (CVE-2026-0740) in the Ninja Forms File Uploads plugin for WordPress allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. This flaw, with a CVSS score of 9.8, affects versions up to 3.3.26 and has been actively exploited, with over 3,600 attacks blocked in the last 24 hours by Wordfence. Approximately 50,000 websites utilizing this plugin are at risk, as the vulnerability stems from inadequate validation of file types during upload. Discovered by researcher Sélim Lanouar, the flaw was reported on January 8, 2026, and a complete fix was released on March 19, 2026. Users are strongly advised to upgrade to the latest version to mitigate risks. The potential impact includes complete site takeover and deployment of web shells. 6 sources 78

Extracted Entities

50,000 WordPress Sites Exposed to Critical Ninja Forms File Upload RCE Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)