ninja-form-exploit

CVE-2026-0740 — Multi-threaded vulnerability scanner for the Ninja Forms File Upload path traversal issue on WordPress.

Description

main.py scans a list of WordPress targets to determine whether the Ninja Forms File Uploads plugin is vulnerable to CVE-2026-0740. Brief flow:

1. URL normalization (http/https, strip trailing slash)
2. Plugin detection via nfpluginsettings.js marker on the main page
3. Retrieve upload nonce via wp-admin/admin-ajax.php (action=nf_fu_get_new_nonce)
4. Upload PoC file with path traversal and fuzz directory 1–100
5. Verify uploaded file at wp-content/uploads/ninja-forms/{dir}/
6. Save vulnerable target to output file

Requirements

• Python 3.7+
• Library requests

pip install requests

Usage

python main.py <list_target.txt> <number_of_threads>

Example:

python main.py targets.txt 20

Target file format

One URL per line:

example.com
https://site.example
http://another.example

Protocol optional — if absent, the script uses http:// then falls back to https:// on failure.

Output

Output file is reset each time a scan starts.

Terminal status

Configuration (inside main.py)

FILE_NAME = "poc_test.txt"
POC_CONTENT = "GIF89;a <h1>VULNERABILITY_TEST_SUCCESSFUL</h1>"
TIMEOUT = 7
OUTPUT_FILE = "vulnerable_targets.txt"
FUZZ_RANGE = range(1, 101)

Notes

• The script uses verify=False (SSL warning disabled) so that targets with invalid certificates can still be scanned.
• Thread pool processes many targets in parallel according to the second argument.
• Only use on systems you own or have obtained testing permission for.