Critical Vulnerability in Ninja Forms Plugin Exposes 50,000 WordPress Sites to RCE

Cybersecuritynews

Critical Vulnerability in Ninja Forms Plugin Exposes 50,000 WordPress Sites to RCE

First seen 7 Apr 2026, 08:01 UTC • •78.0

Article Content

1 / 7

Browse articles

ThreatCluster •April 8, 2026 at 07:33 UTC

•CVE-2026-0740 allows arbitrary file uploads without authentication.
•Over 50,000 WordPress sites using Ninja Forms are vulnerable to exploitation.
•A complete fix was released on March 19, 2026; users must upgrade immediately.

A critical vulnerability (CVE-2026-0740) in the Ninja Forms File Uploads plugin for WordPress allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. This flaw, with a CVSS score of 9.8, affects versions up to 3.3.26 and has been actively exploited, with over 3,600 attacks blocked in the last 24 hours by Wordfence. Approximately 50,000 websites utilizing this plugin are at risk, as the vulnerability stems from inadequate validation of file types during upload. Discovered by researcher Sélim Lanouar, the flaw was reported on January 8, 2026, and a complete fix was released on March 19, 2026. Users are strongly advised to upgrade to the latest version to mitigate risks. The potential impact includes complete site takeover and deployment of web shells.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 186d ago How this analysis works

Timeline

2026-01-08

Vulnerability discovered and reported to Wordfence

2026-02-10

Partial fix released after patch reviews

2026-03-19

Complete fix released in version 3.3.27

2026-04-07

CVE-2026-0740 published, active exploitation reported

More articles in this cluster (6)

Threat Graph

5 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Zero-day Exploit
T1505.003 - Web Shell

Vulnerability (1)

CVE-2026-0740

Affected Platform (2)

Ninja Forms
WordPress

Relationships

CVE-2026-0740 targets Ninja Forms
CVE-2026-0740 targets WordPress
Zero-day Exploit targets Ninja Forms
Zero-day Exploit targets WordPress
T1505.003 - Web Shell targets Ninja Forms
T1505.003 - Web Shell targets WordPress

Following this threat?

Track CVE-2026-0740 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…