CVE-2026-0740 is a critical vulnerability in the Ninja Forms - File Uploads plugin for WordPress, caused by insufficient validation of uploaded file types in the NF_FU_AJAX_Controllers_Uploads::handle_upload function. This allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution on the affected server. The issue affects all plugin versions up to and including 3.3.26. Partial remediation was introduced in version 3.3.25, with a complete fix implemented in version 3.3.27.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server hosting the vulnerable WordPress plugin. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical impact. No known exploits in the wild have been reported as of the published date.

Upgrade the Ninja Forms - File Uploads plugin to version 3.3.27 or later, where the vulnerability is fully patched. Versions 3.3.25 and 3.3.26 contain only partial fixes and should not be considered secure. Since this is not a cloud service, remediation depends on applying the official plugin update. Patch status is confirmed by the vendor's versioning information in the advisory.