An unauthenticated CSRF flaw exists in the Ninja Forms File Uploads Extension plugin up to version 3.3.26. This weakness allows a remote actor to craft a request that, when executed with the context of a logged‑in administrator, triggers a file upload. The consequence is the ability to upload arbitrary files, potentially including executable code, which would compromise the integrity and confidentiality of the WordPress installation. The vulnerability is a classic CSRF (CWE‑352).

WordPress sites that have the Ninja Forms File Uploads Extension plugin version 3.3.26 or earlier. The flaw resides in the plugin's file upload endpoint and does not affect other WordPress components or plugins.

The CVSS score of 9.6 places the vulnerability in the Critical severity range. Despite this high severity, the EPSS score is less than 1 %, indicating a very low probability of exploitation at the time of analysis, and the flaw is not listed in the CISA KEV catalog. Attacks would likely rely on social engineering to lure an authenticated administrator into visiting a crafted URL, after which the attack capitalizes on the missing CSRF token validation to execute the file upload. No additional authentication or privileges are required beyond the victim’s legitimate session.