Is CVE-2026-81772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81772 being exploited in the wild.

How severe is CVE-2026-81772?

High severity, with a CVSS score of 8.8, published 2 September 2026.

Which products and versions are affected?

Ninja Forms Layout & Styles <= 3.0.31.

Is there a fix for CVE-2026-81772?

A patch was published on 2026-09-02: Fixed in version 3.0.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81772 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81772?

Check whether you run Ninja Forms Layout & Styles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81772: Ninja Forms - Layout & Styles PHP Object Injection

Q: Is there a fix for CVE-2026-81772?

A patch was published on 2026-09-02: Fixed in version 3.0.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-81772 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-81772?

Check whether you run Ninja Forms Layout & Styles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81772 · Severity: high · CVSS 8.8 · Published 2026-09-02

Ninja Forms - Layout & Styles is a popular WordPress plugin for customizing form layouts. An unauthenticated remote attacker can inject malicious PHP objects into the plugin, allowing them to execute arbitrary code on the web server with no authentication required. This could lead to full website compromise, data theft, or installation of malware.

Vendors: Ninja Forms.

Quick answers

Is CVE-2026-81772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81772 being exploited in the wild.
How severe is CVE-2026-81772?: High severity, with a CVSS score of 8.8, published 2 September 2026.
Which products and versions are affected?: Ninja Forms Layout & Styles <= 3.0.31.
Is there a fix for CVE-2026-81772?: A patch was published on 2026-09-02: Fixed in version 3.0.32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81772 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81772?: Check whether you run Ninja Forms Layout & Styles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a PHP Object Injection flaw in Ninja Forms - Layout & Styles version 3.0.31 and earlier. The plugin fails to properly validate user-supplied input before deserializing PHP objects, allowing an unauthenticated attacker to craft a malicious request that instantiates arbitrary classes and triggers dangerous functionality. The vulnerability requires no authentication and is network-reachable, making it easily exploitable at scale. An attacker can achieve remote code execution on the underlying server. The plugin was patched in version 3.0.32.

Affected products

Ninja Forms Layout & Styles <= 3.0.31

Timeline

2026-09-02: disclosed: CVE published on NVD
2026-09-02: patched: Fixed in version 3.0.32
2026-03-10: other: Reported by Marc-André Beaulieu

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.