CVE-2026-0740: 
WordPress vulnerability analysis and mitigation

CVE-2026-0740 is a critical arbitrary file upload vulnerability in the Ninja Forms - File Uploads plugin for WordPress, caused by missing file type validation in the NF_FU_AJAX_Controllers_Uploads::handle_upload function. It affects all plugin versions up to and including 3.3.26, with approximately 50,000 WordPress sites exposed. The vulnerability was disclosed on April 7, 2026, with a partial patch in version 3.3.25 and a full patch in version 3.3.27. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) — the plugin's AJAX upload handler NF_FU_AJAX_Controllers_Uploads::handle_upload fails to validate the type or extension of uploaded files before saving them to the server. An unauthenticated attacker can send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with a malicious PHP file payload, bypassing any file type restrictions. Because no authentication or privilege is required, exploitation is trivially achievable from the network with low complexity. A public PoC exploit (shadow.py) automates nonce fetching, file upload, and webshell execution, and a Nuclei detection template has also been published (GitHub Advisory, Wordfence, PoC GitHub).

Successful exploitation allows unauthenticated remote attackers to upload arbitrary files — including PHP webshells — to the WordPress server, enabling full remote code execution (RCE) under the web server's process account. This results in complete compromise of confidentiality, integrity, and availability of the affected WordPress installation, including access to the database (credentials, user data, content), the ability to deface or destroy the site, and potential for lateral movement to other services on the same host or network. The broad install base (~50,000 sites) significantly amplifies the aggregate risk (Wordfence, BleepingComputer).

Active in-the-wild exploitation has been confirmed by Wordfence, which published a dedicated blog post on attackers actively exploiting this vulnerability (Wordfence Active Exploitation). A high-confidence, functional Python PoC (shadow.py) is publicly available on GitHub, featuring automated nonce fetching, mass exploitation workflow, and webshell upload/execution (PoC GitHub). A second PoC repository has also appeared (PoC2 GitHub), and the vulnerability is listed on Exploit-DB (EDB-ID:52560) and Sploitus. The EPSS score is reported at approximately 17.4% (95th percentile) by GitHub Advisory, though Feedly lists a lower estimate of 0.083%. Detection coverage is available via Qualys (ID: 733943) and Nuclei templates. No specific threat actor attribution has been publicly reported.

1. Reconnaissance: Identify WordPress sites running the Ninja Forms - File Uploads plugin (versions ≤ 3.3.26) using tools like WPScan, Shodan, or Censys. Look for the plugin's presence via /wp-content/plugins/ninja-forms-uploads/ paths or plugin enumeration.
2. Nonce Fetching: Send a GET request to the target WordPress site to retrieve a valid WordPress nonce required for the AJAX upload request. The public PoC (shadow.py) automates this step by parsing the site's HTML for the nonce value.
3. Craft Malicious Upload Request: Prepare a PHP webshell file (e.g., shell.php) containing a command execution payload such as <?php system($_GET['cmd']); ?>.
4. Upload via AJAX Endpoint: Send a crafted HTTP POST request to /wp-admin/admin-ajax.php with the action parameter targeting the file upload handler, attaching the PHP webshell as the file payload and including the fetched nonce. No authentication is required.
5. Locate Uploaded File: Determine the upload path (typically under wp-content/uploads/ninja-forms/ or a similar directory) where the server saves the uploaded file without extension restriction.
6. Execute Webshell: Access the uploaded PHP file via the browser or HTTP request (e.g., https://target.com/wp-content/uploads/ninja-forms/shell.php?cmd=id) to achieve remote code execution on the server.
7. Post-Exploitation: Use the webshell to establish a reverse shell, exfiltrate database credentials from wp-config.php, pivot to other services, or install a persistent backdoor (PoC GitHub, Wordfence Active Exploitation).

• Network: Unusual HTTP POST requests to /wp-admin/admin-ajax.php with multipart file upload payloads containing .php, .phtml, .php5, or other executable extensions; outbound connections from the web server process to unknown external IPs (reverse shell activity).
• File System: Unexpected PHP files (e.g., shell.php, cmd.php, webshell.php) in WordPress upload directories such as wp-content/uploads/ninja-forms/; newly created files with randomized names and .php extensions in upload paths; modification timestamps on upload directories inconsistent with normal site activity.
• Logs: Web server access logs showing POST requests to /wp-admin/admin-ajax.php with action=upload or similar parameters followed by GET requests to files in upload directories with query parameters like cmd=, exec=, or c=; error logs showing PHP execution from upload directories.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx/PHP-FPM spawning /bin/bash, curl, wget, python, nc); unexpected cron jobs or scheduled tasks added under the web server user account.
• Database: New WordPress admin accounts created without authorization; changes to wp_options table (e.g., siteurl, admin_email) indicating site takeover (Wordfence Active Exploitation, PoC GitHub).

Immediately upgrade the Ninja Forms - File Uploads plugin to version 3.3.27 or later, which contains the full patch; version 3.3.25 contained only a partial fix and remains vulnerable (GitHub Advisory, Wordfence). If immediate patching is not possible, consider temporarily disabling the Ninja Forms File Uploads plugin or restricting access to /wp-admin/admin-ajax.php via WAF rules or IP allowlisting. Web Application Firewalls (WAFs) such as Wordfence, Check Point (CPAI-2026-2918), and Citrix NetScaler WAF (Signatures v174 R1289) have published signatures to detect and block exploitation attempts. Audit the WordPress upload directories for any suspicious PHP files and remove them immediately if found.

Wordfence, which discovered and reported the vulnerability, published two blog posts — one announcing the initial disclosure affecting ~50,000 sites and a follow-up confirming active exploitation in the wild (Wordfence, Wordfence Active Exploitation). BleepingComputer, SC World, GBHackers, CyberSecurityNews, and The Hacker News all covered the vulnerability, highlighting the critical severity and active exploitation (BleepingComputer). Security researchers on Mastodon (infosec.exchange, swecyb.com) and Bluesky shared alerts and PoC references shortly after disclosure. Lexfo published a technical write-up (Lexfo Blog), and Truesec also released a detailed analysis. The Reddit WordPress community discussed the flaw, and CISA included it in its weekly vulnerability bulletin (SB26-103).