CVE-2026-91827
Received Received - Intake

PHP Object Injection in Ninja Forms WordPress Plugin

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: WPScan

Description
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-91827
EUVD
EUVD-2026-84283

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpninjas ninja_forms 3.15.3
wpninjas ninja_forms to 3.15.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure deserialization issue in the Ninja Forms WordPress plugin version 3.15.3. Unauthenticated attackers can exploit it by submitting malicious form field values that get deserialized when an administrator exports submissions to CSV. This leads to PHP Object Injection, which may allow arbitrary file operations or remote code execution if a suitable POP chain exists in another plugin or theme.

Detection Guidance

Check if Ninja Forms version 3.15.3 is installed on your WordPress site. You can do this by navigating to the WordPress admin panel, going to Plugins, and looking for Ninja Forms. If the version is 3.15.3, the site is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on your server, potentially taking full control of your WordPress site. It may also enable unauthorized file operations, leading to data theft, defacement, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update Ninja Forms to version 3.15.4 or later immediately. This version includes the fix for the PHP Object Injection vulnerability. You can update via the WordPress admin panel under Plugins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart