CVE-2026-12557 is an authorization bypass vulnerability (CWE-862) in the SaturdayDrive Ninja Forms - File Uploads WordPress plugin. Versions up to and including 3.3.29 do not properly verify whether a user is authorized to access or modify plugin debug logs. As a result, unauthenticated attackers can read sensitive debug log entries or permanently delete all entries in the wp_nf3_log table. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No official patch or remediation guidance has been published yet.

An attacker without authentication can read all debug log entries stored by the plugin, potentially exposing sensitive information. Additionally, the attacker can delete all rows in the debug log table, causing loss of diagnostic data. There is no direct confidentiality or availability impact beyond log deletion, but integrity of the logs is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's debug log database table and monitor for suspicious activity related to unauthorized access attempts. Avoid exposing debug logs publicly and consider disabling debug logging if feasible.