CVE-2026-15160
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This allows authenticated attackers with subscriber-level access and above to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.
Risk Assessment
The risk involves the ability for an attacker with low privileges to remotely write files, potentially leading to server compromise by placing a malicious file.
Recommendation
It is recommended to immediately update the Ninja Forms - Excel Export plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Ninja Forms - Excel Export
See all- CVE-2026-15161Medium
The Ninja Forms - Excel Export plugin for WordPress up to version 3.3.6 is vulnerable to Stored Cross-Site Scripting. This is due to missing capability checks, nonce verification, and input sanitization in the save_filter() AJAX handler, which stores the raw $_POST['filter'] array into a WordPress option, combined with the get_filter_row() method on the admin Excel Export screen concatenating stored filter values directly into HTML attributes without esc_attr().
- CVE-2026-15159Medium
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user-controlled key. This allows authenticated attackers with subscriber-level access and above to enumerate any Ninja Forms form ID and download all stored submission data as an XLSX file.
Original NVD description (English source)
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.