{"id":"CVE-2019-10869","aliases":["EUVD-2019-2593","GHSA-mfw8-6m9g-8vvr"],"status":"published","title":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for...","description":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08059,"percentile":0.94833,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22","CWE-434"],"published":"2019-05-07T17:07:57Z","modified":"2026-08-17T18:30:59Z","exploits":[{"source":"pocgithub","id":"KTN1990/CVE-2019-10869","title":"KTN1990/CVE-2019-10869","date":"2019-05-12","url":"https://github.com/KTN1990/CVE-2019-10869"}],"products":[{"vendor":"ninjaforms","product":"ninja_forms_file_uploads"}],"references":[{"url":"https://www.onvio.nl/nieuws/ninjaforms-vulnerability","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://wpvulndb.com/vulnerabilities/9272","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://wpscan.com/vulnerability/e5898e0e-db43-4641-b2cd-f6a72cdb8993/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10869"},{"url":"https://wpscan.com/vulnerability/e5898e0e-db43-4641-b2cd-f6a72cdb8993"},{"url":"https://github.com/advisories/GHSA-mfw8-6m9g-8vvr"}],"sources":{"cve":[{"id":"CVE-2019-10869","description":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.","status":"published","published":"2019-05-07T17:07:57Z","modified":"2026-08-17T17:23:04.844Z","updated_at":"2026-11-02T14:20:18.746972Z"}],"euvd":[{"id":"EUVD-2019-2593","description":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.","status":"published","published":"2019-05-07T17:07:57Z","modified":"2026-08-17T17:23:04Z","updated_at":"2026-11-02T18:01:48.853514Z"}],"ghsa":[{"id":"GHSA-mfw8-6m9g-8vvr","title":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for...","description":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.","status":"published","published":"2022-05-24T16:45:17Z","modified":"2026-08-17T18:30:59Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:10:34.652326Z"}],"nvd":[{"id":"CVE-2019-10869","description":"Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.","status":"published","published":"2019-05-07T18:29:01.223Z","modified":"2026-08-17T18:16:32.24Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22","CWE-434"],"updated_at":"2026-11-02T14:05:13.880207Z"}]}}