fixnx
mediumCVE-2026-15160

Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.

Browse WordPress security risks
ProductNinja Forms - Excel Export
CVSS4.3
EPSS0.00459
UpdatedJuly 19, 2026

Quick answer

Ninja Forms - Excel Export should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.

Who is affected

Affected versions

  • up to and including 3.3.6

Fixed versions

  • 3.3.7

How to fix it

Ninja Forms - Excel Export is affected by CVE-2026-15160, a path traversal and arbitrary XLS file write flaw in Ninja Forms export. A subscriber can write spreadsheet files outside the normal temporary directory and stage later attacks. Update Ninja Forms - Excel Export to 3.3.7 or a newer vendor-supported patched release. Prioritize exposed production systems and accounts that can reach the affected feature.

  1. Inventory every Ninja Forms - Excel Export deployment, version, exposed endpoint, environment, and owner.
  2. Confirm the installed release is not an affected version up to and including 3.3.6.
  3. Update Ninja Forms - Excel Export to 3.3.7 or a newer vendor-supported patched release.
  4. Until the update is complete, disable the Excel Export add-on, reject path separators in spreadsheet_export_tmp_name, and restrict filesystem write permissions.
  5. Review relevant logs and look for ../ or encoded traversal in AJAX traffic and unexpected XLS or XLSX files outside normal export paths.
  6. Remove staged files, inspect them and nearby directories for chained payloads, and restore safe file ownership and permissions.
  7. Clear WordPress, object, page, CDN, and browser caches, then update the asset inventory and close any temporary controls only after validation.

Scan now. Google sign-in is only needed to unlock fix guidance.

Verify the fix

  • Confirm Ninja Forms - Excel Export is on the patched version or mitigation stated above and record the exact deployed version.
  • Confirm a subscriber cannot control the export path and all generated files remain inside the approved temporary directory.
  • Confirm the affected WordPress REST, AJAX, form, shortcode, upload, export, or admin feature is available only to the roles and requests that need it.
  • Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
  • Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-15160.

Related categories

WordPressAuthorization BypassPath Traversal

Related security risks

More published guidance from the same primary category.

medium

Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter

Updated July 19, 2026

medium

Ninja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter

Updated July 19, 2026

high

CVE-2026-65500 Manual - Documentation, Knowledge Base & Education WordPress Theme vulnerability

Updated July 24, 2026

Trusted references

Wordfence advisoryWordfence, NVDSource advisoryWordfence, NVDSource advisoryWordfence, NVDSource advisoryWordfence, NVDSource advisoryWordfence, NVDWordfence advisoryWordfence, NVD

FAQ

What is affected by CVE-2026-15160?

Ninja Forms - Excel Export versions listed as affected should be reviewed: up to and including 3.3.6.

What should I fix first?

Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.

How do I confirm the fix worked?

Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.

How are Fixnx security risk categories chosen?

Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.