Unauthenticated PHP Object Injection allows an attacker to craft a request that deserializes arbitrary PHP objects within the Ninja Forms - Layout & Styles plugin. This flaw is identified as CWE-502 (Deserialization of Untrusted Data) and can lead to arbitrary code execution or the compromise of the underlying WordPress site. The vulnerability works without authentication, meaning any visitor to the site could potentially trigger the insecure deserialization. The vulnerability is not limited to file upload or command injection; it can execute arbitrary PHP code through the deserialized objects.

The issue is present in the Saturday Drive Ninja Forms - Layout & Styles plugin for all versions up to and including 3.0.31. Users running any earlier releases that have not yet been upgraded to a patched version are at risk.

The CVSS base score of 8.8 places this flaw in the High severity category. EPSS data is not available, but the fact that the vulnerability is unauthenticated suggests a high likelihood of exploitation, especially on publicly accessible WordPress sites. The flaw is not listed in the CISA KEV catalog, yet it remains a critical risk due to its remote exploitation potential. Attackers can reach the vulnerable endpoint through normal web traffic, submit a malicious payload, and gain execution rights on the server.