The Ninja Forms WordPress plugin allows user‑submitted form data to be deserialized when an administrator exports submissions to CSV. This deserialization flaw is a classic case of deserializing untrusted data, which can be exploited to perform PHP Object Injection. If an attacker can supply a serialized object that references classes available through another plugin or theme, the compromised site could run arbitrary PHP code or perform unauthorized file operations.

WordPress sites that run the Ninja Forms plugin version 3.15.3 are affected.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exact likelihood of exploitation is unclear; however, the attack vector involves an unauthenticated user submitting data, followed by an authenticated administrator exporting those submissions. If a suitable PHP Object Population (POP) chain exists via another component, the risk escalates to remote code execution, making this a critical exposure for sites relying on that plugin.