A critical flaw in the Ninja Forms – File Uploads add-on for WordPress lets attackers who are not logged in delete files on affected websites, and could lead to a full site takeover. Tracked as [CVE-2026-126537](https://cvefeed.io/vuln/detail/CVE-2026-126537), it was published on 11 November 2026, affects all versions up to and including 3.3.36, and carries a CVSS score of 9.1 out of 10. VulnCheck's exploit tracker has also [flagged it in its Known Exploited Vulnerabilities feed](https://cyber.eventmonitor.net/incident/EM-20261111-ZPBM/critical-vulnerability-cve-2026-126537/). ## How the flaw works The weakness is a path traversal flaw, listed as CWE-22, in the way the add-on handles background file uploads. When a public form submission carries a particular save-progress flag, the plug-in leaves attacker-supplied file details unchecked, and a missing upload identifier means the server never reloads the authoritative file path. With no check that the path stays inside the upload directory, an attacker can point the deletion routine at any file on the server. The danger goes beyond deleted files. The same weakness can expose files stored through connected S3, Dropbox or Google Drive accounts, and deleting the site's wp-config.php file forces WordPress back into its setup screen, which an attacker can then use to take over the site. The CVE record rates the flaw as network-exploitable with low complexity and no user interaction. ## What site owners should do Site owners running Ninja Forms with the File Uploads add-on should update to the latest available release and check for unexplained missing files or unexpected changes, including files synced to S3, Dropbox or Google Drive through the plug-in. This is a separate flaw from the arbitrary file upload bug patched in version 3.3.27 in March 2026, so sites that applied that earlier fix are still exposed until they update again.