Ninja Forms PHP Object Injection via Unsafe Deserialization

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 447matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Ninja Forms WordPress plugin version 3.15.3 contains a critical PHP Object Injection vulnerability (CWE-502) that exploits unsafe deserialization of user-submitted form data during CSV export operations. An unauthenticated attacker can inject malicious serialized PHP objects into form fields, which remain dormant until an administrator exports submissions to CSV. If a suitable Property-Oriented Programming (POP) chain exists in another installed plugin or theme, this vulnerability can escalate to arbitrary file operations or remote code execution. This affects any WordPress site running the vulnerable plugin version, making it a widespread risk despite requiring administrative interaction to trigger the payload execution.

Casky's 447 mapped security skills leverage Claude's extended reasoning to detect this attack across three critical MITRE ATT&CK phases: Initial Access (TA0001) identifies how unauthenticated form submissions bypass entry controls; Execution (TA0043) flags suspicious deserialization patterns and POP chain gadget chains within WordPress environments; and Persistence (TA0002) detects post-exploitation artifacts like unexpected file writes or code execution traces. Practitioners using Casky would observe findings highlighting anomalous serialized object structures in form field payloads, suspicious class instantiation patterns during CSV processing, and detection of known gadget chains from common WordPress plugins—enabling security teams to identify exploitation attempts before administrative CSV exports trigger payload execution.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

447 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-91827.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-91827

Casky has 447 skills that investigate the attack patterns behind CVE-2026-91827. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn