This vulnerability allows an attacker to upload any file to the server because the plugin does not validate the file type in the upload handler. By uploading a malicious script, an attacker can potentially execute code on the host, compromising confidentiality, integrity, and availability. The weakness is identified as CWE‑434, an unrestricted upload of a potentially dangerous file type.

The issue affects the Ninja Forms – File Uploads WordPress extension supplied by SaturdayDrive. All releases up to and including version 3.3.26 are susceptible. Version 3.3.25 discloses a partial mitigation, while the full fix is available only from version 3.3.27 onward.

The CVSS score of 9.8 indicates a high‑severity vulnerability, and the lack of EPSS data does not diminish its danger. Because the upload endpoint is publicly accessible without authentication, the likelihood of exploitation is high. Attackers that successfully upload a malicious file can run arbitrary code on the server, potentially taking over the site.