CVE-2026-11363

Deferred Deferred - Pending Action

PHP Object Injection in Ninja Forms WordPress Plugin

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Wordfence

Description

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The deserialization is triggered automatically during form import when WPN_Helper::build_nf_cache() invokes $action->get_settings() immediately after the crafted form is imported, requiring no further interaction beyond the import action itself.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-11363

EUVD

EUVD-2026-74608

Affected Vendors & Products

Vendor	Product	Version / Range
ninja_forms	ninja_forms	to 3.14.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is a PHP Object Injection issue in the Ninja Forms WordPress plugin up to version 3.14.6. It allows authenticated attackers with admin access to inject a PHP object via deserialization of untrusted input. The attack is triggered during form import when a crafted form is imported, requiring no further interaction.

Detection Guidance

Check for unauthorized form imports in Ninja Forms logs. Look for suspicious PHP deserialization activity in web server logs. Review admin-level user actions around form imports. Use WordPress security plugins to scan for vulnerable versions of Ninja Forms.

Impact Analysis

If another plugin or theme with a POP chain is installed, attackers could exploit this to delete files, retrieve sensitive data, or execute code. Without a POP chain, the impact is limited to object injection.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if an attacker exploits it to retrieve sensitive data or execute code. Since authenticated attackers with admin access can inject PHP objects, unauthorized access to personal or health data may occur if a POP chain is present in another plugin or theme. This could lead to data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Update Ninja Forms to the latest version. Remove admin-level access for untrusted users. Disable form import functionality if not needed. Monitor for unusual file changes or data access. Consider disabling PHP object injection in PHP settings if possible.

Hi! I’m here to help you understand CVE-2026-11363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70