50,000 WordPress Sites Exposed to Critical Ninja Forms File Upload RCE Vulnerability

A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-0740) in the Ninja Forms – File Upload WordPress plugin allows attackers to upload malicious PHP webshells via path traversal and improper filename validation, enabling remote code execution and full server compromise; approximately 50,000 sites were affected and a complete patch was released in version 3.3.27, so administrators must update immediately.