Is the Ninja Forms File Uploads add-on on your WordPress sites still unpatched?
The official CVE record, published on 11 November 2026, describes CVE-2026-126537 in the Ninja Forms File Uploads add-on for WordPress, in versions up to and including 3.3.36. The CVE record lists CVSS 3.1 9.1 Critical. An unauthenticated form submission can cause the add-on to delete, or exfiltrate, a server file of the attacker's choosing. Deleting wp-config.php can return WordPress to setup and allow takeover. The vendor changelog dates the 3.3.37 fix on 2 November 2026. Update now.
Not in CISA KEV when checked on 11 November 2026. Update the File Uploads add-on to 3.3.37 or later.
CVE-2026-126537 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 14:09 GMT on 11 November 2026 (catalogue 2026.11.10, released at 19:03 UTC on 10 November, before this CVE was published). Recheck KEV. We make no claim either way about exploitation. The official CVE record and NVD list the File Uploads add-on as affected in versions up to and including 3.3.36. The vendor changelog dated 2 November 2026 is the 3.3.37 release. Update to 3.3.37 or later.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 11 November 2026, 14:31 GMT.
At a Glance
Based on the official CVE record, the NVD record, the Ninja Forms File Uploads changelog, and CISA KEV, as of 11 November 2026. Last updated 11 November 2026, 14:31 GMT.
Critical, CVSS 3.1 9.1
The official CVE record lists CVSS 3.1 9.1 Critical, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The NVD record was in Deferred status when we checked, shows the CNA 9.1 as Primary, and has not scored it itself. The vendor changelog does not give a score.
Not in CISA KEV
CVE-2026-126537 was not in CISA KEV when checked at 14:09 GMT on 11 November 2026 (catalogue 2026.11.10, which predates this CVE). Recheck KEV. We make no claim either way about exploitation.
File Uploads add-on <= 3.3.36
The official CVE record and NVD list the Ninja Forms - File Uploads add-on, versions up to and including 3.3.36. They do not list the core Ninja Forms plugin. We do not make a further claim about the core plugin.
3.3.37 or later
The vendor changelog dates File Uploads 3.3.37 on 2 November 2026 and lists security enhancements, including hardening how uploaded file data is handled during form submission. It does not name the CVE or give a score. The official CVE record was published on 11 November 2026.
The official CVE record's timeline says the vendor was notified on 13 October 2026.
The Ninja Forms File Uploads changelog lists 3.3.37, with security enhancements that include hardening the handling of uploaded file data during form submission. The changelog does not name CVE-2026-126537 or give a score.
The official CVE record's timeline lists disclosure on 11 November 2026 at 00:01 UTC.
The official CVE record for CVE-2026-126537 is published, with CVSS 3.1 9.1 Critical.
The NVD record is published, in Deferred status, and shows the CNA 9.1 as Primary. NVD has not scored it itself.
CVE-2026-126537 is not in CISA KEV catalogue 2026.11.10 (released at 19:03 UTC on 10 November, before this CVE was published). Recheck KEV.
What the official records describe
The official CVE record and NVD say: 'The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36.' They also say that unauthenticated attackers can delete arbitrary files on the affected site's server, which may make remote code execution possible, and that deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover.
In high-level terms, an unauthenticated form submission can cause the add-on to delete, or exfiltrate, a server file of the attacker's choosing. Deleting wp-config.php can return WordPress to setup and allow takeover.
The official CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, which sets confidentiality impact to None. The official description also mentions arbitrary file read via S3, Dropbox or Google Drive integrations. We report both as published and do not reconcile them. The official CVE record lists CWE-22. Credit in the official record is to a security researcher.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Update the add-on
- Vendor path: the File Uploads changelog dated 2 November 2026 is 3.3.37. The official CVE record and NVD list versions up to and including 3.3.36 as affected. Update the add-on to 3.3.37 or later. See the Ninja Forms File Uploads changelog.
- Our advice: find every client or in-house WordPress site that runs the File Uploads add-on. In the WordPress plugin list, RMM inventory or a managed WordPress dashboard, look for ninja-forms-uploads, and record the exact version.
- Our advice: update every site still on 3.3.36 or earlier to 3.3.37 or later.
- Our advice: until a site is updated, disable the File Uploads add-on, or take forms with upload fields off public pages.
- Our advice: keep off-server backups of wp-config.php and the site files, not only backups stored on the same server.
- Our advice: if wp-config.php disappears on a site running 3.3.36 or older, do not complete the WordPress setup screen. Restore from a known-good off-server backup, rotate the database credentials and salts, and review admin accounts and recently changed PHP files.
Hunt and contain
- Our advice: check whether any affected site has been returned to the WordPress setup screen, or whether wp-config.php or other unexpected files are missing.
- Our advice: if wp-config.php disappears on a site running 3.3.36 or older, do not complete the WordPress setup screen. Restore from a known-good off-server backup, rotate the database credentials and salts, and review admin accounts and recently changed PHP files.
- Our advice: review form submissions and file-upload activity you cannot account for, especially on sites that were running 3.3.36 or earlier while the form was public.
- Our advice: if a site looks compromised, take it offline, restore from a known-good off-server backup, and rotate WordPress, database, FTP or SFTP, and hosting credentials, plus any secrets that were in wp-config.php.
Proactive: Vendor Steps, Then Ours
The vendor's fixed release first, then our advice for inventory and temporary exposure reduction. Our advice is not a substitute for the official CVE record, NVD or the vendor changelog.
Update File Uploads to 3.3.37 or later
The official CVE record and NVD list the Ninja Forms - File Uploads add-on as affected in versions up to and including 3.3.36. The vendor changelog dates 3.3.37 on 2 November 2026 and includes security enhancements, among them 'harden handling of uploaded file data during form submission'. Update to 3.3.37 or later. The changelog does not name the CVE or give a score.
Find every site running the add-on
Inventory WordPress sites you or your clients run, including managed WordPress and agency estates. In the plugin list, RMM inventory or a managed WordPress dashboard, look for the File Uploads add-on, which appears as ninja-forms-uploads, and record the version. The official CVE record and NVD list only this add-on. They do not list the core Ninja Forms plugin, and we do not make a further claim about the core plugin.
Until you can update, reduce exposure
Our advice, not the vendor's: until a site is on 3.3.37 or later, disable the File Uploads add-on, or take forms with upload fields off public pages. Keep off-server backups of wp-config.php and the site files.
If wp-config.php disappears
Our advice, not the vendor's: if wp-config.php disappears on a site running 3.3.36 or older, do not complete the WordPress setup screen. Restore from a known-good off-server backup, rotate the database credentials and salts, and review admin accounts and recently changed PHP files.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-ninja-forms-uploads.sh
Read-only, offline checker. It reads plug-in headers under a WordPress folder, a saved plugin-list file, or a version you pass. It never contacts the site or the vendor, never runs PHP or WP-CLI, and writes nothing. If you point it at a WordPress root, it also checks, read only, that wp-config.php is present.
bash check-ninja-forms-uploads.sh --path /var/www/html
bash check-ninja-forms-uploads.sh --list plugins.csvCheck-NinjaFormsUploads.ps1
The same checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.
pwsh -File Check-NinjaFormsUploads.ps1 --path C:\inetpub\wwwroot\siteKQL and Sigma
15 KQL hunts (Q1 to Q1d are inventory; Q2 to Q5d are our patterns). 6 Sigma rules, all our patterns. These hunts are CybaVerse hunting ideas, not vendor guidance and not IOCs. None of the KQL has been run against a live tenant. Request bodies are usually not logged, so the web log hunts can see URLs and sequences only.
Verdicts
- PATCHEDFile Uploads add-on 3.3.37 or above.
- NOT LISTEDThe add-on was not found. Core Ninja Forms alone is not listed as affected in the CVE record.
- VULNERABLEFile Uploads add-on 3.3.36 or below.
- UNKNOWNVersion missing or unreadable, a non-numeric or pre-release version, a version between 3.3.36 and 3.3.37, or the add-on folder without its main file.
- WP-CONFIG MISSINGNo wp-config.php where WordPress looks, and the add-on verdict is not VULNERABLE.
Exit codes
| Code | Meaning |
|---|---|
| 0 | PATCHED or NOT LISTED |
| 1 | VULNERABLE |
| 3 | UNKNOWN |
| 4 | Usage or read error |
| 5 | WP-CONFIG MISSING (with --path, when the verdict is not VULNERABLE) |
MSPs can use the exit code in RMM or scheduled jobs.
Know the limits
- Q2 to Q5d, and all six Sigma rules, are our own patterns, not the vendor's. Q1 to Q1d are inventory. None of these hunts prove exploitation.
- Request bodies are usually not logged, so the web log hunts see URLs and sequences only.
- These items are unverified: parameter names come only from the CVE description, because the add-on's code is not public; which AJAX action reaches the bug; whether ver= on asset requests always matches the add-on version; and customers' log field layouts.
- None of the KQL has been run against a live tenant.
- Webserver and proxy Sigma rules convert only where a matching table exists. Converted queries may need a file-deleted filter added by hand before use.
What is in the pack
| File | What it does |
|---|---|
| check-ninja-forms-uploads.sh | Read-only checker for Linux and macOS (bash) |
| Check-NinjaFormsUploads.ps1 | The same checker in PowerShell 7 |
| KQL (15 hunts) | Q1 to Q1d inventory; Q2 to Q5d our patterns |
| Sigma (6 rules) | All our patterns, plus Kusto conversions (in the full pack) |
| tests/ | Fixtures and tests (in the full pack; 50 files in total) |
| README.md | Verified facts, vendor advice versus ours, limits and usage |
Reactive: How to Hunt (Our Advice)
The hunts below, and the pack downloads, are CybaVerse advice. Q2 to Q5d and all six Sigma rules are our own patterns. Q1 to Q1d are inventory.
Confirm versions and public forms
Confirm which sites still run the File Uploads add-on below 3.3.37, and which of those still expose forms with upload fields on public pages. Use the pack checker and the Q1 inventory hunts.
Look for setup-mode or missing files
Look for WordPress sites that have been returned to the setup screen, and for unexpected absence or replacement of wp-config.php or other site files. These are our patterns, not official indicators. If wp-config.php disappears on a site running 3.3.36 or older, do not complete the WordPress setup screen. Restore from a known-good off-server backup, rotate the database credentials and salts, and review admin accounts and recently changed PHP files.
Review activity you cannot account for
Review form submissions, upload activity and file changes around the period an affected version was public, especially changes you cannot tie to a known editor or change window. Request bodies are usually not logged.
If you find signs of compromise (our advice)
- Take the site offline and keep logs, form records and a copy of the remaining site files for investigation.
- If wp-config.php disappears on a site running 3.3.36 or older, do not complete the WordPress setup screen.
- Restore from a known-good off-server backup, or rebuild, then update the File Uploads add-on to 3.3.37 or later before the site goes public again.
- Rotate the database credentials and salts, plus WordPress, FTP or SFTP, and hosting credentials, and any other secrets that were stored in wp-config.php, including cloud storage keys used by the add-on.
- Review admin accounts and recently changed PHP files, and other files you did not change.
- Start incident response if the site held customer data or could reach other systems.
Ninja Forms File Uploads CVE-2026-126537 FAQ
Short answers based on the official CVE record, the NVD record, the Ninja Forms File Uploads changelog, and CISA KEV, checked on 11 November 2026.
What is CVE-2026-126537?
The official CVE record, published on 11 November 2026, covers the Ninja Forms - File Uploads add-on for WordPress in versions up to and including 3.3.36. It describes arbitrary file deletion, and also mentions arbitrary file read via S3, Dropbox or Google Drive exfiltration. In high-level terms, an unauthenticated form submission can cause the add-on to delete, or exfiltrate, a server file of the attacker's choosing. Deleting wp-config.php can return WordPress to setup and allow takeover. The official record credits a security researcher.
How severe is it, and why does the vector say confidentiality is None?
The official CVE record lists CVSS 3.1 9.1 Critical, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. That vector sets confidentiality impact to None. The official description also mentions arbitrary file read via S3, Dropbox or Google Drive integrations. We report both as published and do not reconcile them. The NVD record was in Deferred status when we checked on 11 November 2026, shows the CNA 9.1 as Primary, and has not scored it itself. The vendor changelog does not give a score.
Is this being exploited, or is it in CISA KEV?
CVE-2026-126537 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 14:09 GMT on 11 November 2026 (catalogue 2026.11.10, released at 19:03 UTC on 10 November, before this CVE was published). Recheck KEV. We make no claim either way about exploitation.
Which software is affected, and when was the fix released?
The official CVE record and NVD list only the Ninja Forms - File Uploads add-on, versions up to and including 3.3.36. They do not list the core Ninja Forms plugin, and we do not make a further claim about the core plugin. The vendor changelog dates 3.3.37 on 2 November 2026. The official CVE record was published on 11 November 2026, and the NVD record at 13:17 UTC that day.
What should we do first?
Update the File Uploads add-on to 3.3.37 or later, which is the vendor changelog release after the affected 3.3.36 line. Our advice: find every site running ninja-forms-uploads; until you can update, disable the add-on or take upload forms off public pages; keep off-server backups of wp-config.php. If wp-config.php disappears on a site running 3.3.36 or older, do not complete the setup screen, restore from backup, rotate database credentials and salts, and review admin accounts and recently changed PHP files.
Who is this relevant to?
Organisations and MSPs that run WordPress sites with the Ninja Forms File Uploads add-on, especially where forms with upload fields are public. The official records list this add-on only.
Protect Your WordPress Estate, and Your Customers'
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- NVD: CVE-2026-126537 (Deferred; shows the CNA CVSS 3.1 9.1 as Primary; NVD has not scored it itself; published 11 November 2026, 13:17 UTC)
- Official CVE record: CVE-2026-126537 (published 11 November 2026, 12:34 UTC)
- Ninja Forms: File Uploads add-on changelog (3.3.37 dated 2 November 2026)
- CISA: Known Exploited Vulnerabilities catalogue (checked 11 November 2026, 14:09 GMT; catalogue 2026.11.10, released 10 November 2026 at 19:03 UTC)