The vulnerability resides in the upload handler of the Ninja Forms – File Uploads plugin for WordPress, where missing file‑type validation allows any file to be stored on the server. An attacker can exploit this to upload a malicious script or binary, paving the way for code execution and potential site takeover. The weakness is classified as CWE‑434, representing an unrestricted upload of potentially dangerous file types.

This issue affects all releases of the Ninja Forms – File Uploads WordPress extension supplied by SaturdayDrive up to version 3.3.26. A partial mitigation was introduced in 3.3.25, but the full fix is only available in version 3.3.27 and later.

With a CVSS score of 9.8 and an EPSS score of 0.21968, the vulnerability is severe but with a low exploitation probability. Because the upload endpoint remains publicly accessible without authentication, attackers can readily reach the vector. Once a malicious file is uploaded, code execution is possible, compromising confidentiality, integrity, and availability of the affected site.