CVE-2026-15160 is a directory traversal vulnerability (CWE-22) in the Ninja Forms - Excel Export plugin for WordPress. It affects all versions up to and including 3.3.6. The flaw exists in the handling of the 'spreadsheet_export_tmp_name' parameter, which does not properly restrict pathname input, enabling authenticated attackers with subscriber-level privileges or higher to write .xls/.xlsx files to arbitrary server locations. This unauthorized file write capability can be leveraged to facilitate additional attacks on the affected system.

Authenticated users with subscriber-level access or higher can exploit this vulnerability to write arbitrary Excel files to any location on the server. While this does not directly lead to confidentiality or availability loss, it allows integrity compromise and can be used to stage further attacks, such as code execution or privilege escalation, depending on the server environment and additional vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious file writes related to the plugin. Avoid granting unnecessary privileges to users and consider disabling the plugin if it is not essential.