The vulnerability in the Ninja Forms – File Uploads plugin allows an attacker to read any file that the web server can access. The flaw arises when the get_files_for_attachment() routine accepts a client‑supplied 'files' array after the process() method exits early because a saveProgress flag was sent. The attacker‑supplied file_path value bypasses all upload validation and path normalization, and is later passed to wp_mail() as an attachment after only a file_exists() check. This results in an uncontrolled confidentiality breach (CWE‑22) without impacting the integrity or availability of the system.

Any WordPress site that has the SaturdayDrive Ninja Forms – File Uploads plugin version 3.3.29 or earlier is affected. The vulnerability is independent of the WordPress core or PHP version and can be exploited on any server hosting the plugin.

The CVSS base score of 7.5 classifies the issue as high severity. The EPSS score of <1% indicates that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by sending a crafted POST request to the upload endpoint with the saveProgress flag, resulting in arbitrary file read for any file accessible to the web server.