Vulnerability · Published Sep 22, 2026 · Assigned by WPScan

CVE-2026-91827Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

High 7.5

In plain English

A high-severity unsafe deserialization in Ninja Forms from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Ninja Forms	3.15.3 – before 3.15.4

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/7b279db2-92e0-4122-b5c6-aa12b7b01858/ exploit, vdb-entry, technical-description