Ninja Forms - File Uploads vulnerabilities

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in versions up to 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path, allowing arbitrary file read, write, or deletion on the server.

The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.29 inclusive contains an authorization bypass vulnerability. Unauthenticated attackers can read all debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table.

The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.29 is vulnerable to Arbitrary File Read. The attach_files() function improperly handles a raw attacker-controlled 'files' array, bypassing upload validation, path normalization, and database record creation, allowing an unauthenticated attacker to read arbitrary files on the server.