CVE-2026-92820: Arbitrary File Operations in Ninja Forms

Ninja Forms: RCE and arbitrary file operations via S3 upload. CVSS 8.1 high, requires configured S3.

The Ninja Forms plugin for WordPress contains CVE-2026-92820, enabling arbitrary file operations (read, write, delete) via external upload with Amazon S3. An unauthenticated attacker can manipulate the file path to read, write, or delete server files, with potential for remote code execution.

CVSS score is 8.1 (high), consistent with concrete risk. Reported to NVD on October 2, 2026, with 2 social posts in the last 24h. No verified public exploit is reported. It requires Amazon S3 configured and form Email action for file read.

If running Ninja Forms: verify the version (vulnerable up to 3.3.34) and temporarily disable External File Upload with S3 until patch available. Apply updates as soon as released, monitor official advisories, and audit file access logs. Focus on mitigation and patching, not exploit testing.

At a glance

What: Ninja Forms plugin for WordPress allows arbitrary file operations (read, write, delete) via the external upload flow (Amazon S3) in CVE-2026-92820. An unauthenticated attacker can supply an arbitrary file path that the plugin uses without validation, enabling remote code execution if written output is placed in an executable location.
Severity: CVSS 8.1 (high). Enables arbitrary file read, write, and delete operations with potential remote code execution when written content is executable.
Affected versions: Ninja Forms Plugin for WordPress up to and including version 3.3.34.
Fix: Not reported in available data. Consult official plugin advisories for patch availability.
Status: Known vulnerability (NVD October 2, 2026), moderate social signals (2 posts in last 24h requesting PoC), no declared public exploit, requires Amazon S3 configured.
Action: If running Ninja Forms: verify installed version immediately, temporarily disable External File Upload (S3) until patch available, apply updates as soon as available, monitor official advisories, audit file access logs for anomalies.

Sources: NVD, CVE-2026-92820

← All articles