Description
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
WordPress Plugin Ninja Forms 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.wordfence.com/blog/2026/04/50000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-ninja-forms-file-upload-wordpress-plugin/
https://nvd.nist.gov/vuln/detail/CVE-2026-0740
https://www.truesec.com/hub/blog/critical-vulnerability-in-ninja-forms-file-upload-wordpress-plugin-cve-2026-07409
https://www.cycognito.com/blog/emerging-threat-cve-2026-0740-ninja-forms-file-upload-unauthenticated-rce/
https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-flaw-in-ninja-forms-wordpress-plugin/
https://www.sentinelone.com/vulnerability-database/cve-2026-0740/
https://www.tenable.com/plugins/was/115221
https://github.com/advisories/GHSA-v8wq-rjpf-669f
https://avd.aliyun.com/detail?id=AVD-2023-5601