CVE-2026-126537 | SaturdayDrive Ninja Forms Plugin up to 3.3.36 on WordPress File Upload upload.php process file_path path traversal

A vulnerability marked as critical has been reported in SaturdayDrive Ninja Forms Plugin up to 3.3.36 on WordPress. This affects the function NF_FU_Fields_Upload::process of the file includes/fields/upload.php of the component File Upload. Performing a manipulation of the argument file_path results in path traversal.

This vulnerability is cataloged as CVE-2026-126537. It is possible to initiate the attack remotely. There is no exploit available.VulDB Recent EntriesRead More