PHP Object Injection Vulnerability in Ninja Forms by WP Ninjas
CVE-2026-81772

8.8HIGH

Key Information:

Vendor

WordPress
Status
Ninja Forms - Layout & Styles
Vendor
CVE Published:
2 September 2026

What is CVE-2026-81772?

The Ninja Forms - Layout & Styles plugin for WordPress has a vulnerability that allows unauthenticated PHP Object Injection in versions up to 3.0.31. This flaw can potentially be exploited to manipulate serialized objects and execute arbitrary code, posing significant risks to websites utilizing this plugin. It is critical for users of affected versions to apply updates promptly and follow best practices to secure their installations.

Affected Version(s)

Ninja Forms - Layout & Styles <= 3.0.31

References

https://patchstack.com/database/wordpress/plugin/ninja-fo...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marc-André Beaulieu (h3dg3h0g) | Patchstack Bug Bounty Program
.