Back Gbhackers

50,000 WordPress Sites Running Ninja Forms Vulnerable to Critical File Upload RCE

Gbhackers •Divya • April 7, 2026

A severe security flaw has been discovered in the Ninja Forms File Upload plugin, a widely utilized WordPress add-on that allows website administrators to accept documents, images, and other media from their visitors. Tracked officially as CVE-2026-0740, this unauthenticated arbitrary file upload vulnerability carries a maximum critical CVSS score of 9.8. With an estimated 50,000 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Ninja Forms Plugin Exposes 50,000 WordPress Sites to RCE A critical vulnerability (CVE-2026-0740) in the Ninja Forms File Uploads plugin for WordPress allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. This flaw, with a CVSS score of 9.8, affects versions up to 3.3.26 and has been actively exploited, with over 3,600 attacks blocked in the last 24 hours by Wordfence. Approximately 50,000 websites utilizing this plugin are at risk, as the vulnerability stems from inadequate validation of file types during upload. Discovered by researcher Sélim Lanouar, the flaw was reported on January 8, 2026, and a complete fix was released on March 19, 2026. Users are strongly advised to upgrade to the latest version to mitigate risks. The potential impact includes complete site takeover and deployment of web shells. 6 sources 78

Extracted Entities

CVEs (1)

CVE-2026-0740

Platforms (2)

Ninja Forms WordPress