Wordfence published an unauthenticated arbitrary file deletion flaw in the Ninja Forms - File Uploads add-on on 11 November 2026, tracked as CVE-2026-126537 and rated 9.1. The route it opens is a deleted wp-config.php, which puts a WordPress site back on its installer screen.
What happened
The upload field's process() function returns early whenever a public submission carries a non-empty extra.saveProgress value, so the client-supplied files array is never validated. If the same request also omits upload_id, the plugin's external upload service has nothing to reload from and the attacker's data[file_path] value survives into the background upload queue unchanged.
That path is then used twice: as the source file for an S3, Dropbox or Google Drive transfer, and as the argument to the unlink() call that removes the local copy afterwards. The plugin's own is_path_within_upload_dir() check only runs on administrator paths, so traversal sequences and absolute paths pass through untouched.
Deleting wp-config.php is the payoff. WordPress finds no configuration file, drops into its setup screen, and whoever completes that screen first controls which database the site uses.
Who is affected
- WordPress sites running Ninja Forms - File Uploads 3.3.36 or earlier
- Sites with a published form that has a file upload field, which is the normal reason the add-on is installed
- Hosts where the web user can write to the WordPress root, the standard shared-hosting layout used by most South African SME sites
What to do now
Update Ninja Forms - File Uploads to 3.3.37 or later today. This is a one-click plugin update, not a maintenance-window job.
- Confirm the add-on reports version 3.3.37 under Plugins; the Ninja Forms core plugin version is not the one that matters here
- If the update cannot go in immediately, deactivate the add-on or remove file upload fields from any form reachable by the public
- Look for a missing wp-config.php or a site that suddenly serves the setup page, and treat either as an intrusion rather than a glitch
- Search web logs for POST requests carrying saveProgress together with a file_path value that contains traversal or an absolute path
What this means for South African businesses
Ninja Forms is one of the most common contact-form plugins on local small-business sites, and the file upload add-on is usually installed by whoever built the form and then never reviewed again. Because the flaw needs no login, it is exactly the kind of bug that gets swept up by automated scanning within days of publication.
The practical risk here is not a stolen database but a site that is wiped or silently hijacked and discovered on a Monday morning, which for a small business means days offline and a scramble to prove to clients that nothing else was touched.
Source: Wordfence Intelligence advisory for CVE-2026-126537.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.