CVE-2026-91827

Summary

The Ninja Forms WordPress plugin has a PHP Object Injection vulnerability when exporting form submissions to CSV, allowing unauthenticated attackers to inject malicious objects that can be executed during deserialization. This creates a high-risk vector for remote code execution if POP chains exist in other plugins or themes.

Exploitability

Exploitation requires an unauthenticated attacker to submit a form with malicious serialized data and then wait for an administrator to export submissions to CSV, making it moderately difficult but possible.

Blast radius

If exploited, this vulnerability could allow attackers to perform arbitrary file operations or execute remote code on the WordPress server, potentially compromising the entire site and its data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Ninja Forms plugin version 3.15.4 or later to address the PHP Object Injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.