CVE-2026-126537

{
  "etk_id": "ETK-2026-4170",
  "cve_id": "CVE-2026-126537",
  "display_id": "CVE-2026-126537",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-123410",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated arbitrary file deletion in Ninja Forms - File Uploads",
  "summary": "Ninja Forms - File Uploads versions through 3.3.36 are affected by an arbitrary file deletion flaw. An unauthenticated attacker may delete files on the WordPress server and could potentially take over the site by removing critical configuration files. Exploitation requires access to a public form using the affected upload functionality.",
  "mitigation": "Disable the Ninja Forms - File Uploads add-on or remove public access to forms that use its upload functionality until a vendor update is available. Restrict access to affected WordPress sites and monitor for unexpected file deletions.",
  "vendor": "SaturdayDrive",
  "product": "Ninja Forms - File Uploads",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.3.36"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Ninja Forms - File Uploads",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.2756264333333333,
  "t0_at": "2026-11-11T12:34:45.417000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-11T12:57:38.490674+00:00",
      "days": 0.015892056412037038,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T12:34:45.417000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T12:34:45.417000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T12:34:45.417000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126537"
    }
  }
}