CVE-2026-91827: Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running Ninja Forms version 3.15.3 are exposed if unauthenticated visitors can submit values to a form and an administrator later exports the affected submissions to CSV.
What must an attacker do to exploit the vulnerability?
An attacker must submit crafted form field values without authentication. Exploitation is triggered only when an administrator subsequently exports the relevant form submissions to CSV.
Is remote code execution guaranteed?
No. The issue permits PHP object injection, but arbitrary file operations or remote code execution require a suitable POP chain in another installed plugin or theme.
What can be done while patching is not immediately possible?
Avoid exporting Ninja Forms submissions to CSV, particularly submissions that may have been received from untrusted users. Restrict or disable public form submissions where feasible until the affected plugin is remediated.