Attackers Actively Exploiting Critical Vulnerability in Ninja Forms – File Upload Plugin

On April 6th, 2026, we publicly disclosed a critical Arbitrary File Upload vulnerability in Ninja Forms – File Upload, a WordPress plugin with an estimated 50,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including PHP backdoors, and achieve remote code execution. The vendor released the fully patched version on March 19th, 2026, and we originally disclosed this vulnerability in the Wordfence Intelligence vulnerability database and a blog post about the vulnerability on April 6th, 2026. Our records indicate that attackers started exploiting the issue the same day, on April 6th, 2026. The Wordfence