CVE-2026-0740: Ninja Forms File Uploads RCE — Are You Still Exposed?

CVE-2026-0740 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in the Ninja Forms — File Uploads add-on for WordPress, not the core Ninja Forms plugin. It lets an attacker upload a PHP webshell with no login required, and roughly 50,000 sites were still running a vulnerable version months after a patch was released — because the first fix didn’t actually close the hole.

What CVE-2026-0740 Actually Does

The File Uploads add-on validates the file extension on the name the visitor submits, but not the name it actually saves the file under on the server. An attacker can submit a form with a crafted filename that passes the extension check, then have the plugin write it to disk as a working .php file. Once that file lands in an accessible directory, the attacker has full remote code execution on the server — no account, no admin access, nothing but a public-facing form.

Why the March Patch Wasn’t Enough

This is the part worth paying attention to even if you patched months ago:

• Version 3.3.25 (released to address the issue) only partially fixed the validation logic — researchers found it was still exploitable after this update.
• Version 3.3.27, released March 19, 2026, is the first version that fully closes the vulnerability.
• If your site updated to 3.3.25 and you assumed you were covered, you likely weren’t.

Version	Status	What to do
3.3.26 and earlier	Fully vulnerable	Update immediately
3.3.25	Partially patched — still exploitable	Update immediately, don’t assume you’re safe
3.3.27 or later	Fully patched	Confirm version, no further action

How to Check If Your Site Is Affected

1. In wp-admin, go to Plugins and search for “Ninja Forms” — the File Uploads add-on is listed separately from core Ninja Forms.
2. Check the version number against the table above.
3. If you’re on 3.3.26 or earlier (including 3.3.25), update to 3.3.27 or later now.
4. If you’re not sure whether the add-on is even installed but forms on your site accept file uploads, check your plugin list directly rather than assuming — this is exactly the kind of dependency that gets missed in a quick scan.
5. After updating, check wp-content/uploads/ for any unfamiliar .php files as a precaution — if the site was already compromised, a version update alone won’t remove a webshell that’s already been planted.

If You Find Something Suspicious

An unfamiliar PHP file in your uploads folder, unexpected admin users, or outbound traffic you can’t explain are signs of a live compromise, not just an unpatched vulnerability. We cover the concrete recovery steps — not just “restore a backup” — in WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. If you’d rather have someone check a client or dealership site directly, get in touch and we can take a look.

Frequently Asked Questions

Is Ninja Forms core affected by CVE-2026-0740?

No. The vulnerability is specifically in the separate Ninja Forms — File Uploads add-on, not the main Ninja Forms plugin. If you don’t have that specific add-on installed, this CVE doesn’t apply to you.

I updated in March — am I safe?

Only if you’re on version 3.3.27 or later. If you updated to 3.3.25 and stopped there, that version was still exploitable. Check your installed version directly rather than relying on memory of when you last updated.

How do attackers actually find vulnerable sites like this?

Automated scanners crawl the web looking for the specific plugin’s file signatures and version strings, then attempt the exploit against every match they find — no manual targeting required. This is why an unpatched critical vulnerability gets exploited at scale within days of becoming public, regardless of how small or obscure a site is.

Featured image: original illustration.