A serious security hole exists in the Ninja Forms File Uploads add-on for WordPress, allowing unauthorized users to upload any type of file, potentially leading to them taking control of the server.

This flaw, known as CVE-2026-0740, is being actively used in attacks. Wordfence, a WordPress security company, says their firewall has stopped over 3,600 attacks in the last day.

Ninja Forms, with over 600,000 downloads, is a popular WordPress plugin for creating forms easily. Its File Upload extension, which is part of the same package, has 90,000 customers.

The CVE-2026-0740 vulnerability has a critical rating of 9.8 out of 10 and affects Ninja Forms File Upload versions up to 3.3.26.

Wordfence researchers say the problem is that the plugin doesn’t properly check the types or extensions of files being uploaded, which allows attackers to upload any file, including PHP scripts, and even change the file names to access restricted areas.

Wordfence explains that “the function doesn’t check the file type or extension of the destination filename before moving the file in the vulnerable version.”

“This means that not only can safe files be uploaded, but files with a .php extension can also be uploaded.”

“Because the filename isn’t cleaned up, the attacker can also use path traversal to move the file to the webroot directory.”

“This allows unauthorized attackers to upload malicious PHP code and then access it to run code on the server.”

The consequences of exploiting this vulnerability could be severe, including the installation of web shells and complete control of the site.

Security researcher Sélim Lanouar (whattheslime) found the vulnerability and reported it to Wordfence’s bug bounty program on January 8.

After confirming the issue, Wordfence shared the details with the vendor on the same day and added temporary protection for its customers through firewall rules.

Following reviews of the fixes and a partial fix on February 10, the vendor released a complete fix in version 3.3.27, which has been available since March 19.

Given that Wordfence is seeing thousands of attempted attacks every day, Ninja Forms File Upload users are strongly advised to update to the latest version as soon as possible.