{"id":"CVE-2019-10869","title":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated)","summary":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22","CWE-434"],"vendor":"ninjaforms","product":"ninja_forms_file_uploads","affected":["ninja_forms_file_uploads < 3.0.23"],"patched":["ninja_forms_file_uploads 3.0.23"],"published":"2019-05-07","updated":"2026-08-17","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-10869","references":[{"url":"https://wpscan.com/vulnerability/e5898e0e-db43-4641-b2cd-f6a72cdb8993/","label":"cve@mitre.org"},{"url":"https://wpvulndb.com/vulnerabilities/9272","label":"cve@mitre.org"},{"url":"https://www.onvio.nl/nieuws/ninjaforms-vulnerability","label":"cve@mitre.org"},{"url":"https://wpvulndb.com/vulnerabilities/9272","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.onvio.nl/nieuws/ninjaforms-vulnerability","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.07994,"epssPercentile":0.94592,"ingestedAt":"2026-08-17T18:59:01.650Z","exploits":{"github":1,"githubRepos":["https://github.com/KTN1990/CVE-2019-10869"],"checkedAt":"2026-09-21T15:23:40.222Z"},"exploitAvailable":true,"slug":"CVE-2019-10869","body":"## Overview\n\nPath Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.\n\n## Affected\n\n- `ninja_forms_file_uploads < 3.0.23`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `ninja_forms_file_uploads 3.0.23`","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":44.6,"likelihood":1.6,"exploitation":12,"ransomware":0},"changes":[{"seq":4457,"id":"CVE-2019-10869","ts":1788887180863,"field":"exploit_available","old":"false","new":"true"},{"seq":3340,"id":"CVE-2019-10869","ts":1788886299828,"field":"exploit_available","old":"true","new":"false"},{"seq":2195,"id":"CVE-2019-10869","ts":1788882969530,"field":"exploit_available","old":"false","new":"true"},{"seq":1224,"id":"CVE-2019-10869","ts":1788882375659,"field":"exploit_available","old":"true","new":"false"},{"seq":338,"id":"CVE-2019-10869","ts":1788881816120,"field":"exploit_available","old":"false","new":"true"},{"seq":132,"id":"CVE-2019-10869","ts":1787084018482,"field":"epss","old":"0.13018","new":"0.07994"}]}