Ninja Forms CVE-2026-11363

Exploitation requires two simultaneous conditions: (1) the attacker must hold a WordPress administrator account (or higher) on the target site, granting access to the form import interface; and (2) at least one other installed plugin or theme on the same WordPress installation must contain a usable POP chain - without this, the deserialized object cannot perform any harmful actions. The deserialization is triggered automatically as part of the form import action in WPN_Helper::build_nf_cache(); no additional interaction is required after the crafted form file is submitted. Sites running Ninja Forms in isolation with no POP-chain-bearing co-plugins are not exploitable. Sites where administrators are trusted and no POP chains are present face effectively zero risk from this specific CVE.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) yields a score of 6.6, which accurately reflects the compound prerequisites: an attacker must already hold WordPress administrator credentials (PR:H) AND a POP chain-bearing plugin or theme must be present on the target site (AC:H). Without a POP chain, the vulnerability has zero direct impact - this is explicitly stated in the description. Consequently, real-world risk is highly environment-dependent: a default Ninja Forms installation with no vulnerable co-plugins is not at risk, while a site running popular plugins known to contain POP chains (e.g., older WooCommerce, Elementor, or Yoast versions) could face full compromise. No EPSS data was provided; given the PR:H and AC:H constraints, spontaneous mass exploitation is unlikely. No CISA KEV listing and no confirmed public exploit further support treating this as a low-urgency, conditional risk for most deployments. Administrators should nonetheless patch promptly, as admin-level WordPress compromise is achievable through many vectors and a co-installed POP chain may not be immediately obvious.

An attacker who has obtained WordPress administrator credentials - through phishing, credential stuffing, or a prior compromise - navigates to the Ninja Forms Import/Export panel and uploads a crafted form JSON file containing a serialized PHP object with a malicious class name. The import triggers WPN_Helper::build_nf_cache(), which calls $action->get_settings() and deserializes the injected object, invoking the __wakeup or __destruct magic methods of a class provided by a co-installed plugin such as an older WooCommerce version. The resulting POP chain executes attacker-controlled code, allowing file deletion or full server-side code execution under the web server's user context. No public exploit or proof-of-concept code has been confirmed at time of analysis.