Threats tagged 'ghsa-rfc5-f6j6-9jgj'

The Ninja Forms - File Uploads add-on for WordPress versions up to and including 3.3.36 contains a critical vulnerability allowing unauthenticated attackers to delete arbitrary files on the server. This flaw arises from improper handling of file paths in background upload processing, enabling deletion of sensitive files such as wp-config.php. Exploiting this can lead to remote code execution and full site takeover by forcing WordPress into its setup mode.