WordPress Plugin Vulnerabilities

Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

Description

The plugin does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.

Proof of Concept

Affects Plugins

Plugin icon
ninja-forms
Fixed in 3.15.4

References

CVE
CVE-2026-91827

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
7b279db2-92e0-4122-b5c6-aa12b7b01858

Timeline

Publicly Published
2026-09-22 (about 9 hours ago)
Added
2026-09-22 (about 2 hours ago)
Last Updated
2026-09-22 (about 2 hours ago)

Other

Published
Title
Published
2025-05-21
Title
Pix 4x sem juros - Pagaleve < 1.6.10 - Unauthenticated PHP Object Injection
Published
2026-06-23
Title
BuddyBoss Platform < 3.0.5 - Authenticated (Subscriber+) PHP Object Injection
Published
2025-05-20
Title
Grand Tour | Travel Agency WordPress <= 5.5.1 - Unauthenticated PHP Object Injection
Published
2026-06-05
Title
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms < 1.1.5 - Unauthenticated PHP Object Injection
Published
2024-03-18
Title
Tourfic < 2.11.19 - Authenticated (Subscriber+) PHP Object Injection