CVE-2026-13369 Path traversal in Ninja Forms - File Uploads
Unauthenticated attackers can read arbitrary files on the server via a path traversal vulnerability in the Ninja Forms File Uploads plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13369?
CVE-2026-13369 is a high-severity path traversal vulnerability in SaturdayDrive Ninja Forms - File Uploads, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.
Weakness: CWE-22
Which versions are affected by CVE-2026-13369?
How do I fix CVE-2026-13369?
No fix has been published for CVE-2026-13369 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-13369 being exploited?
There is no known exploitation of CVE-2026-13369 in the wild and no public exploit code.
Sources
Also known as GHSA-2298-wc49-vm4h.