9.8

CVE-2022-0888: ninjaforms ninja_forms_file_uploads

CVSS: 9.8v3.1CriticalModified
Published 23-03-2022Last modified 08-04-2026
Open JSON

Vulnerability summary

CVE-2022-0888 is a critical (CVSS 9.8) vulnerability in ninjaforms ninja_forms_file_uploads. EPSS estimates a 39.39% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
39.39%
0%100%
High · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 23-03-2022
    PublishedVulnerability first disclosed.
  2. 08-04-2026
    Last modifiedVulnerability information updated.

Description

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

39.39%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 39.39% on 19-09-2026

19-09-202619-10-2026
EPSS score
39.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    5F0Accbbfdee279C68Ed144Da9Cd8607

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Ninjaforms1 product
Saturdaydrive1 product
Wordpress1 product
  • ninja-forms-uploads≤ 3.3.0 (fixed in 3.3.1)

3 vendors · 3 products

References

4 links