Ninja Forms EUVD-2026-84283

Exploitation requires the Ninja Forms plugin version 3.15.3, which deserializes user-submitted form field values during the administrator CSV export of form submissions. The attacker's payload can be planted unauthenticated by anyone able to submit a form (PR:N), but the deserialization sink only fires when an administrator later performs the 'export submissions to CSV' action (UI:R). Achieving arbitrary file operations or remote code execution additionally depends on a suitable POP (property-oriented programming) gadget chain being present in another installed plugin or theme - without such a chain the object injection has limited practical impact. These two gates (admin-initiated export plus an available POP chain in the co-installed extension stack) are the primary factors limiting real-world exploitation.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) describes an unauthenticated network-reachable flaw whose full C:H/I:H/A:H impact is explicitly conditional - the description states RCE/file operations occur only 'if a suitable POP chain is present via another installed plugin or theme.' That conditionality is correctly reflected in AC:H and is the single most important risk qualifier: without a usable POP gadget chain in the co-installed plugin/theme stack, the primary object-injection sink yields limited or no impact. Exploitation also requires UI:R - an administrator must actively export form submissions to CSV to trigger deserialization - so this is not a fire-and-forget remote exploit despite the network vector. A public exploit exists (WPScan), but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or automated exploitation; treat POC availability and active exploitation as distinct signals. Net: a genuine, high-value bug on a very widely deployed plugin, but real-world exploitability is gated by (1) presence of a POP chain and (2) an admin performing the export. Missing data to flag explicitly: CWE is 'N/A' in the input though this is unambiguously a deserialization/PHP Object Injection class (CWE-502/CWE-915); EPSS and KEV status are absent (absence is not evidence of low risk, merely unmeasured); CPE vendor is recorded as 'unknown' rather than the actual maintainer (Saturday Drive).

An unauthenticated attacker submits a Ninja Forms form on a victim WordPress site, placing a crafted serialized PHP object payload into a form field value, which is stored with the submission. Later, an administrator exports the collected submissions to CSV, at which point the stored value is deserialized; if a POP gadget chain exists in another installed plugin or theme, this drives arbitrary file operations or remote code execution. A public exploit for this vulnerability is available via WPScan.