CVE-2023-36505 is a medium severity (6.8) improper input validation flaw in the Ninja Forms Contact Form plugin for WordPress, through version 3.6.24. Patchstack's entry title calls it arbitrary file deletion. Update to a release newer than 3.6.24 and confirm the changelog.
What's affected
The record says the Ninja Forms Contact Form plugin, from Saturday Drive, is affected in versions from n/a through 3.6.24, which means every release up to and including 3.6.24.
The record does not name a fixed version. The reference is a Patchstack database entry, and its title describes the issue as an arbitrary file deletion vulnerability. I could not open the page, since it refused an automated request, so I am relying on the title and the record. Any release after 3.6.24 is the direction to move, and the plugin's changelog should show the first release that addresses it.
Ninja Forms is widely installed, and many sites run an old version because forms keep working. That is exactly why this one deserves a look, even at a medium score.
How to check if you're exposed
Use WP-CLI on any site where you have shell access.
wp plugin list --fields=name,status,version,update
wp plugin get ninja-forms --field=version
Without shell access, open Plugins in the WordPress admin and read the version under Ninja Forms. Anything at or below 3.6.24 is affected.
Look at the other side too. The record's vector says a high privilege account is needed, so check who holds administrator rights on each site. A long list of old admin accounts raises the risk of this flaw far more than the plugin version alone.
For agencies and hosts with many customers, run the same check across every site and export the result to a sheet.
What to do now
- Find every WordPress site with Ninja Forms and record the version.
- Update to the latest release, test your forms, and check the changelog for a note on this issue.
- Review administrator accounts and remove any that are not needed. The record's vector requires high privileges.
- Turn on two factor authentication for administrators.
- Keep recent backups of the site files, so a deleted file can be restored.
- Set up automatic plugin updates or a monthly review for form plugins.
Why it matters
The record classes this as CWE-20, improper input validation. The plugin accepts a value and does not check it well enough before acting on it. The reference title says that results in arbitrary file deletion, which means files outside the plugin's own folder could be removed.
The score is 6.8. The vector needs a network connection and, importantly, high privileges. It is scored with a changed scope and high availability impact, because deleting the wrong file, such as the site configuration, can take a site offline. It is not on CISA's Known Exploited Vulnerabilities list, and I found no claim of exploitation.
File deletion bugs in WordPress matter more than they look. Removing a configuration file can send a site into its install screen, which can then be abused. Even when a flaw needs an admin account, those accounts get phished and reused, so patching still counts.
Try it yourself
This demo shows how continuous monitoring keeps an inventory of components and flags the ones that fall behind an advisory.
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
The record's vector requires high privileges, which means an administrator level account.
Which release fixes it?
The record does not say. Update past 3.6.24 and read the changelog, since I could not open the Patchstack entry.
Sources
- Patchstack entry for Ninja Forms (cited by the record; blocked to automated fetch)
- Safeguard Gold entry for CVE-2023-36505
Last reviewed: 19 October 2026.
