CVE-2019-10869

8.1 highEPSS 8.1%

High (8.1) in ninjaforms ninja forms file uploads. EPSS 8.1% chance of exploitation in the next 30 days.

Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 8.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-434
Published: 2019-05-07
Modified: 2026-08-17
Record from: the NVD, synced 2026-10-19

Affected

ninjaforms:ninja_forms_file_uploads

References

https://wpscan.com/vulnerability/e5898e0e-db43-4641-b2cd-f6a72cdb8993/
https://wpvulndb.com/vulnerabilities/9272
https://www.onvio.nl/nieuws/ninjaforms-vulnerability
https://wpvulndb.com/vulnerabilities/9272
https://www.onvio.nl/nieuws/ninjaforms-vulnerability

Check your stack JSON