Medium severity4.3NVD Advisory· Published Jul 17, 2026· Updated Jul 17, 2026
CVE-2026-15160
CVE-2026-15160
Description
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.
Affected products
1- Range: <=3.3.6
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/browser/ninja-forms-excel-export/trunk/includes/Admin/ExtractPostData.phpnvd
- plugins.trac.wordpress.org/browser/ninja-forms-excel-export/trunk/includes/Handlers/ExportFile.phpnvd
- plugins.trac.wordpress.org/browser/ninja-forms-excel-export/trunk/ninja-forms-excel-export.phpnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/24fb24cc-c29f-4d2d-87ba-5d211386e7ddnvd
News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)Wordfence Blog · Jul 23, 2026