CVE-2026-13369: Ninja Forms File Uploads Arbitrary File Read Vulnerability

Technical summary

CVE-2026-13369 is a path traversal vulnerability (CWE-22) in the Ninja Forms – File Uploads plugin that stems from insufficient input validation in the attach_files() function. When the process() method returns early due to a saveProgress flag set by the client, the get_files_for_attachment() function accepts a raw, attacker-controlled 'files' array without executing standard upload validation, path normalization, or database record creation. The attacker-supplied file_path parameter then reaches wp_mail() with only a file_exists() check, allowing arbitrary files on the server filesystem to be accessed as email attachment payloads. The vulnerability is network-accessible, requires no authentication, and has no user interaction requirement, resulting in a CVSS 3.1 score of 7.5 (HIGH) with confidentiality impact but no integrity or availability impact.

Business impact

Organizations running WordPress with the Ninja Forms – File Uploads plugin are exposed to information disclosure. Attackers can exfiltrate sensitive files including configuration files containing database credentials, private keys, API tokens, customer data, or source code—all without needing to log in or social engineer users. For SaaS platforms, agencies, or multi-tenant WordPress installations, this could expose data across multiple customers or projects. The ease of exploitation combined with the breadth of potential data sources creates significant compliance and reputation risk, particularly for organizations subject to GDPR, HIPAA, or PCI-DSS.

Affected systems

The vulnerability affects WordPress sites with the Ninja Forms – File Uploads plugin installed and active in versions up to and including 3.3.29. Because WordPress plugin vulnerabilities are often discovered and exploited after disclosure, organizations should assume broad targeted scanning is already occurring. Sites with publicly accessible form endpoints are at higher risk of opportunistic exploitation. The plugin popularity means the exposure could be widespread across small business, nonprofit, and enterprise WordPress deployments.

Exploitability

This vulnerability is highly exploitable. No authentication is required, the attack is trivial to execute (a single malicious HTTP request), and there is no user interaction barrier. An attacker with basic HTTP client knowledge can craft requests to retrieve files like wp-config.php or .env files from the web root within seconds. Exploit automation is straightforward, making mass scanning and opportunistic attacks probable. The lack of complex preconditions (such as requiring a specific plugin configuration or user action) means any unpatched instance is immediately at risk.

Remediation

Update the Ninja Forms – File Uploads plugin to a version released after July 2, 2026, that addresses this vulnerability. Verify the patched version number against the official Ninja Forms security advisory or plugin repository before deployment. If an immediate patch is unavailable, disable the Ninja Forms – File Uploads plugin or restrict access to forms containing file upload fields via .htaccess, WAF rules, or network ACLs until a fix is available. Monitor file access logs for suspicious requests to common sensitive paths (wp-config.php, .env, etc.).

Patch guidance

Visit the WordPress plugin repository or the Ninja Forms official website to check for an available security update addressing CVE-2026-13369. The vulnerable version range extends to 3.3.29 (published July 2, 2026). Apply the update immediately upon availability through the WordPress admin interface or via manual deployment. If your site uses automatic updates, ensure they are enabled for plugins. Test the update in a staging environment first to confirm no form functionality is impacted. Verify that the plugin version displayed in the admin panel reflects the patched release.

Detection guidance

Monitor web server access logs for HTTP requests to form endpoints that contain unusual 'files' parameters or saveProgress flags with suspicious file paths (e.g., requests containing '../', absolute paths, or references to /etc/passwd or wp-config.php). Look for POST requests to form processing endpoints with Base64-encoded or URL-encoded path traversal payloads. Implement or review WAF rules to block requests with path traversal sequences in file upload parameters. Use WordPress security plugins to audit installed versions of Ninja Forms and flag any version ≤3.3.29. Check email logs for unusual attachments or email send activity from form submissions. File Integrity Monitoring (FIM) tools can alert on unauthorized access to sensitive configuration files.

Why prioritize this

This vulnerability merits immediate remediation priority. It combines ease of exploitation (unauthenticated, no user interaction), high impact (read access to arbitrary files including secrets), and broad applicability across WordPress deployments. The lack of KEV status does not reduce urgency—disclosure is public and exploitation is trivial. Organizations should treat this as a critical remediation item alongside other high-severity path traversal or information disclosure vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability requiring no privileges or user interaction, with high confidentiality impact and no integrity or availability impact. The score appropriately reflects the threat: widespread, easy-to-exploit information disclosure affecting secret management. Organizations may assign higher internal risk ratings if they host sensitive customer data, use shared hosting, or operate in regulated environments, or if file permissions on their servers are overly permissive.

Frequently asked questions