CVE-2022-0888

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
SaturdayDrive	Ninja Forms - File Uploads	<= 3.3.0

References

https://gist.github.com/Xib3rR4dAr/5f0accbbfdee279c68ed144da9cd8607Exploit, Patch, Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/f00eeaef-f277-481f-9e18-bf1ced0015a0?source=cve
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0888Third Party Advisory
https://gist.github.com/Xib3rR4dAr/5f0accbbfdee279c68ed144da9cd8607Exploit, Patch, Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/f00eeaef-f277-481f-9e18-bf1ced0015a0?source=cve
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0888Third Party Advisory

Timeline

Published: Mar 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08896.1The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the CVE-2022-08905.5NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.CVE-2022-08917.1A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or o CVE-2022-08926.1The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading CVE-2022-08935.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-08945.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.CVE-2022-08959.8Static Code Injection in GitHub repository microweber/microweber prior to 1.3.CVE-2022-08968.8Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.CVE-2022-08974.3A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex b CVE-2022-08985.4The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_htm CVE-2022-08996.1The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an CVE-2022-09005.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NetDataSoft DivvyDrive allows Stored X