CVE-2026-92820 Overview
CVE-2026-92820 is an arbitrary file operation vulnerability in the Ninja Forms - File Uploads plugin for WordPress. The flaw affects all versions up to and including 3.3.34. The plugin trusts an attacker-supplied file path in the external Amazon S3 upload flow and stores it as the upload's file_path without validation. Unauthenticated attackers can read, write, or delete arbitrary files on the server. The write primitive can lead to remote code execution when the external store is configured. Exploitation requires the site to use the plugin's External File Upload (Amazon S3) action, and the arbitrary read variant additionally requires a form Email action configured to attach the uploaded file.
Critical Impact
Unauthenticated attackers can achieve arbitrary file read, write, and deletion on vulnerable WordPress installations, with a path to remote code execution.
Affected Products
- Ninja Forms - File Uploads plugin for WordPress
- All versions up to and including 3.3.34
- WordPress sites using the External File Upload (Amazon S3) action
Discovery Timeline
- 2026-10-02 - CVE-2026-92820 published to NVD
- 2026-10-02 - Last updated in NVD database
Technical Details for CVE-2026-92820
Vulnerability Analysis
The vulnerability resides in the plugin's external upload flow for Amazon S3. The plugin accepts a client-supplied file path from the form submission and persists it as the upload's file_path property. That path is subsequently consumed by three distinct code paths without server-side validation or canonicalization.
The first path attaches the file to the form's notification email, producing an arbitrary file read primitive. The second path writes fetched content to the attacker-supplied location, producing an arbitrary file write primitive. When the external store is configured, this write primitive enables remote code execution by placing PHP into web-accessible directories. The third path performs scheduled deletion, enabling arbitrary file deletion against the WordPress host.
This class of flaw is tracked as CWE-434: Unrestricted Upload of File with Dangerous Type. The attacker requires no authentication, but exploitation complexity is elevated because the target site must have the External File Upload (Amazon S3) action enabled.
Root Cause
The plugin treats a user-controlled form field as a trusted server-side path. No allowlist, path normalization, or directory confinement is applied before the path is written to persistent storage or passed to filesystem APIs.
Attack Vector
An unauthenticated attacker submits a form that triggers the external S3 upload flow. The attacker supplies a crafted file_path value referencing an arbitrary location on the WordPress server. Depending on the subsequent action, the plugin reads, writes, or deletes the referenced file. For remote code execution, the attacker directs the write primitive at a PHP file inside a web-accessible directory.
No verified exploit code is published at this time. See the Wordfence Vulnerability Report for additional technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-92820
Indicators of Compromise
- Unexpected PHP files in wp-content/uploads/ or other WordPress-writable directories with recent modification timestamps
- Ninja Forms submission records whose stored file_path value contains path traversal sequences such as ../ or absolute paths outside the uploads directory
- Outbound HTTP requests from the WordPress host to unexpected S3 buckets controlled by third parties
- Email notifications sent by the site that reference attachments outside the standard upload directory
Detection Strategies
- Audit the Ninja Forms submissions table for file_path values that resolve outside the plugin's configured upload directory
- Compare the Ninja Forms - File Uploads plugin version against 3.3.34 and flag any installation at or below that version
- Monitor WordPress forms using the External File Upload (Amazon S3) action for anomalous submission volume from unauthenticated sources
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress document root and wp-content/ subtrees to detect unauthorized writes
- Log and alert on all PHP file creation events inside directories writable by the web server user
- Correlate web access logs for POST requests to admin-ajax.php or Ninja Forms REST endpoints with subsequent filesystem changes
How to Mitigate CVE-2026-92820
Immediate Actions Required
- Update the Ninja Forms - File Uploads plugin to a version later than 3.3.34 as soon as a patched release is available from the vendor
- Disable the External File Upload (Amazon S3) action on any form where it is not strictly required
- Review all form Email actions and remove configurations that attach uploaded files until the plugin is patched
- Inspect the WordPress filesystem for unauthorized PHP files and remove any that cannot be attributed to a known administrator action
Patch Information
No fixed version is listed in the public advisory at the time of publication. Monitor the Ninja Forms File Uploads Extension page and the Wordfence Vulnerability Report for updates on patched versions.
Workarounds
- Deactivate the Ninja Forms - File Uploads plugin entirely if the External File Upload (Amazon S3) action is in use and a patch is unavailable
- Deploy a web application firewall rule that rejects form submissions containing file_path parameters with traversal sequences or absolute paths
- Restrict the web server user's write permissions on directories that serve PHP, preventing the write primitive from reaching executable locations
- Remove the Amazon S3 credentials configured in the plugin to disable the vulnerable external upload code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
