CVE-2026-91827— Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
Quick assessment
Affected
Unknown Ninja Forms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Ninja Forms | 3.15.3< 3.15.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91827
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
Source: CVE Program / CVE List V5
Vulnerability Description
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Ninja Forms | 3.15.3 ~ 3.15.4 | - |
|
II. Public POCs for CVE-2026-91827
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91827
请登录查看更多情报信息。
Other References for CVE-2026-91827 (1)
-
https://wpscan.com/vulnerability/7b279db2-92e0-4122-b5c6-aa12b7b01858/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-22 · 3 CVEs total
| CVE-2026-92438 | 8.8 HIGH | Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Ad |
| CVE-2026-88788 | Text Styler <= 1.1.1 - Contributor+ Stored XSS |
IV. Related Vulnerabilities
Same product: Ninja Forms
-
CVE-2026-92438
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragrap -
CVE-2026-80437
Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Sho -
CVE-2026-80438
Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post M -
CVE-2026-15256
Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode -
CVE-2026-65052
Ninja Forms Calculation and Payment Total Tampering via Fail
Same vendor: Unknown
-
CVE-2026-92438
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragrap -
CVE-2026-88788
Text Styler <= 1.1.1 - Contributor+ Stored XSS -
CVE-2026-92400
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthen -
CVE-2026-86802
To Do List Member 1.4 - 1.6 - Unauthenticated Content Inject -
CVE-2026-85113
GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execut
V. Comments for CVE-2026-91827
No comments yet