CVE-2026-91827 — Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, al…
Published: 2026-09-22 · CVSS: 7.5 · CVSS 3.1
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7