Download Free Plugin

Ninja Forms

wpdeeply.com/plugins/ninja-forms/
MEDIUM WPDeeply risk rating
Active installations
600,000+
WordPress.org status
Active
Known vulnerabilities
Multiple, historically
Open unresolved
0 in current core release
Last vulnerability
2026 — File Uploads extension (CVE-2026-0740)
PHP compatibility
PHP 7.4+ supported
Maintenance frequency
Active — maintained by Saturday Drive
WPDeeply recommendationSafe to keep if updated. If you use the File Uploads extension, confirm you are on 3.3.27 or later — earlier "fixed" versions were only partially patched.

Data reviewed August 2026. Version numbers move weekly — the WordPress.org listing linked in the sidebar is always authoritative for the current release.

Current security status

Ninja Forms core is actively maintained and listed on WordPress.org. WPDeeply rates it MEDIUM, driven mainly by its extension ecosystem and a 2026 incident in one of its premium add-ons.

Security history

  • October 2020 — CSRF to RCE. A missing request-origin check in front of form-management functionality allowed a crafted link, clicked by a logged-in administrator, to escalate to code execution. Affected 3.4.0–3.4.27, fixed in 3.4.27.1. No CVE was assigned. Write-up: Ninja Forms before 3.4.27.1 — simple CSRF to RCE.
  • 2020 — CVE-2020-12462. A separate CSRF-to-stored-XSS issue in the import routine, reported by Wordfence, fixed in 3.4.24.2.
  • 2026 — CVE-2026-0740 (CVSS 9.8). Unauthenticated arbitrary file upload in the Ninja Forms – File Uploads premium extension, allowing PHP web shells. All versions to 3.3.26 affected; 3.3.25 was a partial fix; 3.3.27 (19 March 2026) is the complete one. Exploitation in the wild was subsequently confirmed. Because the extension is sold separately, it does not update through WordPress.org.

The pattern

Two of the three incidents above involve import or upload handling — functionality that takes a file and acts on it. That is the highest-risk category in the plugin ecosystem, and it is worth extra scrutiny in any form builder.

Recommendation

Keep it updated, and treat premium extensions as a separate maintenance task with its own calendar reminder. If you do not need file uploads on your forms, do not install that extension.