---
id: CVE-2019-10869
title: >-
  Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin
  before 3.0.23 for WordPress (when the Uploads add-on is activated)
summary: >-
  Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin
  before 3.0.23 for WordPress (when the Uploads add-on is activated). This
  allows an attacker to traverse the file system to access files and execute
  code via the…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-22
  - CWE-434
vendor: ninjaforms
product: ninja_forms_file_uploads
affected:
  - ninja_forms_file_uploads < 3.0.23
patched:
  - ninja_forms_file_uploads 3.0.23
published: '2019-05-07'
updated: '2026-08-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-10869'
references:
  - url: 'https://wpscan.com/vulnerability/e5898e0e-db43-4641-b2cd-f6a72cdb8993/'
    label: cve@mitre.org
  - url: 'https://wpvulndb.com/vulnerabilities/9272'
    label: cve@mitre.org
  - url: 'https://www.onvio.nl/nieuws/ninjaforms-vulnerability'
    label: cve@mitre.org
  - url: 'https://wpvulndb.com/vulnerabilities/9272'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.onvio.nl/nieuws/ninjaforms-vulnerability'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.07994
epssPercentile: 0.9451
ingestedAt: '2026-08-17T18:59:01.650Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/KTN1990/CVE-2019-10869'
  checkedAt: '2026-09-24T07:52:46.770Z'
exploitAvailable: true
---

## Overview

Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.

## Affected

- `ninja_forms_file_uploads < 3.0.23`

## Remediation

Upgrade past the affected range:

- `ninja_forms_file_uploads 3.0.23`