The Ninja Forms – File Uploads plugin allows an attacker to read any file that the web server has access to. The flaw exists in the attach_files() and get_files_for_attachment() functions, where a raw client‑supplied 'files' array is accepted after the process() method exits early due to a saveProgress flag. This bypasses all upload validation, path normalization, and database record creation, letting an attacker’s file_path value reach wp_mail() as an email attachment with only a file_exists() check, resulting in uncontrolled confidentiality disclosure (CWE‑22).

Any WordPress site running SaturdayDrive’s Ninja Forms – File Uploads plugin at version 3.3.29 or earlier is impacted. The vulnerability is independent of the WordPress core or PHP version and can be exploited on any server where the plugin is installed.

The CVSS base score of 7.5 indicates high severity. The EPSS score of <1% suggests exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by sending a crafted POST request to the upload endpoint with the saveProgress flag, resulting in arbitrary file read for any file readable by the web server.