CVE-2026-91827

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin version 3.15.3

Description An issue exists where user-submitted form field values are not prevented from being deserialized when an administrator exports form submissions to CSV. This allows unauthenticated attackers to perform PHP Object Injection. If a suitable POP chain (a sequence of gadgets used to execute arbitrary code) is present via another installed plugin or theme, this can lead to arbitrary file operations or remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.