Executive brief
Ninja Forms is a popular WordPress plugin for creating contact forms and collecting user submissions. The plugin contains a PHP Object Injection vulnerability triggered during form import that allows authenticated administrators to inject malicious PHP objects. While the vulnerability itself requires a POP chain (code gadget) from another plugin or theme to have practical impact, an attacker with admin access could potentially execute arbitrary code, delete files, or steal sensitive data if such a chain is present on the site.
Technical details
The vulnerability is a PHP Object Injection (deserialization of untrusted input) in Ninja Forms versions up to 3.14.6. The vulnerable code path is triggered in the form import functionality when WPN_Helper::build_nf_cache() calls $action->get_settings() immediately after a crafted form is imported, which deserializes unsanitized serialized PHP objects. The vulnerability requires authentication at the administrator level and is automatically triggered during the import process without requiring additional user interaction. The impact depends on the availability of a Property-Oriented Programming (POP) chain in co-installed plugins or themes; if such a chain exists, an attacker could achieve arbitrary code execution, file deletion, or data exfiltration. The plugin is vulnerable in all versions up to and including 3.14.6.
Affected products
- Ninja Forms Ninja Forms up to 3.14.6
Timeline
- 2026-09-09: disclosed