WordPress Ninja Forms File Uploads Add-On Arbitrary File Deletion Vulnerability

The Ninja Forms - File Uploads add-on for WordPress is vulnerable to arbitrary file deletion and arbitrary file read via S3/Dropbox/Google Drive exfiltration in versions up to, and including, 3.3.36.

The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php, which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress, and NF_FU_External_Abstracts_Service::process_upload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends upload_id. By omitting upload_id, an attacker's data[file_path] survives into the Background Upload queue and is used by both upload_file_to_s3() (as SourceFile) and the maybe_delete_server_file() unlink() call in includes/external/abstracts/backgroundupload.php, with no canonicalization or upload-directory containment check (the plugin's own is_path_within_upload_dir() helper is only applied on admin paths).

This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server, which may make remote code execution possible. Specifically, deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover.