7.5
High
CVE-2026-91827 The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when…
Description
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ninja Forms 3.15 | 3.15.3 → < 3.15.4 | 3.15.4 |
Other CVEs of Ninja Forms
The 11 CVEs of Ninja Forms →
CVE-2026-92438
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the…
8.8
High
CVE-2026-80437
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from…
4.8
Medium
CVE-2026-80438
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a…
5.9
Medium
CVE-2026-15256
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to…
4.8
Medium