PHP Object Injection Risk in Ninja Forms WordPress Plugin
CVE-2026-91827

7.5HIGH

Key Information:

Vendor

WordPress
Status
Ninja Forms
Vendor
CVE Published:
22 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-91827?

The Ninja Forms plugin version 3.15.3 for WordPress has a critical security flaw that allows unauthorized attackers to exploit user-submitted form data. When form submissions are exported to CSV by an administrator, the plugin fails to properly sanitize the deserialized data, creating an opportunity for PHP Object Injection. If an attacker utilizes another vulnerable plugin or theme that provides a suitable payload object, they could potentially perform malicious actions, including arbitrary file manipulations or executing remote code. Protect your WordPress site by ensuring all plugins are kept up to date and regularly auditing your security posture.

Affected Version(s)

Ninja Forms 3.15.3 < 3.15.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-91827 - Proof of Concept

References

https://wpscan.com/vulnerability/7b279db2-92e0-4122-b5c6-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karthik Ramakrishnan
WPScan
.