The vulnerability resides in the upload handler of the Ninja Forms - File Uploads plugin for WordPress, where missing file-type validation allows any file to be stored on the server. An attacker can exploit this to upload a malicious script or binary, paving the way for code execution and potential site takeover. The weakness is classified as CWE-434, representing an unrestricted upload of potentially dangerous file types.

This issue affects all releases of the Ninja Forms - File Uploads WordPress extension supplied by SaturdayDrive up to version 3.3.26. A partial mitigation was introduced in 3.3.25, but the full fix is only available in version 3.3.27 and later.

With a CVSS score of 9.8 and an EPSS score of 54%, the vulnerability is severe and has a high exploitation probability. Because the upload endpoint remains publicly accessible without authentication, attackers can readily reach the vector. Once a malicious file is uploaded, code execution is possible, compromising confidentiality, integrity, and availability of the affected site.