Ninja Forms Layout Styles
Monthly
PHP Object Injection in the Ninja Forms - Layout & Styles WordPress plugin (versions ≤ 3.0.31) exposes sites to unauthenticated remote code execution through unsafe deserialization of attacker-controlled PHP objects. Classified under CWE-502 (Deserialization of Untrusted Data), the flaw allows a crafted serialized payload to trigger property-oriented programming gadget chains already present in the WordPress plugin environment, yielding full confidentiality, integrity, and availability compromise of the affected server. No active exploitation has been confirmed in the CISA KEV catalog, but the unauthenticated network attack path and high-impact triad (C:H/I:H/A:H) demand immediate remediation across all affected WordPress deployments.
PHP Object Injection in the Ninja Forms - Layout & Styles WordPress plugin (versions ≤ 3.0.31) exposes sites to unauthenticated remote code execution through unsafe deserialization of attacker-controlled PHP objects. Classified under CWE-502 (Deserialization of Untrusted Data), the flaw allows a crafted serialized payload to trigger property-oriented programming gadget chains already present in the WordPress plugin environment, yielding full confidentiality, integrity, and availability compromise of the affected server. No active exploitation has been confirmed in the CISA KEV catalog, but the unauthenticated network attack path and high-impact triad (C:H/I:H/A:H) demand immediate remediation across all affected WordPress deployments.