Ninja Forms - File Uploads vulnerabilities
5 known vulnerabilities in Ninja Forms - File Uploads from SaturdayDrive. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
Ninja Forms - File Uploads: Improper Limitation of a Pathname to a Restricted Directory
The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/
- 8.1 High severity
Ninja Forms - File Uploads: Unrestricted Upload of File with Dangerous Type
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the form submission and
- 7.5 High severity
Ninja Forms - File Uploads: Improper Limitation of a Pathname to a Restricted Directory
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files
- 9.8 Critical severity
Ninja Forms - File Uploads: Unrestricted Upload of File with Dangerous Type
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible
- 9.8 Critical severity
Ninja Forms - File Uploads: Unrestricted Upload of File with Dangerous Type
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthentica