The Ninja Forms plugin for WordPress suffers from a PHP Object Injection vulnerability (CWE-502) in all versions up to 3.14.6. The flaw arises from deserialization of untrusted data during the form import process, specifically when WPN_Helper::build_nf_cache() calls $action->get_settings(). Exploitation requires authenticated administrator access. No proof-of-concept (POP) chain is included in the plugin itself, so exploitation depends on the presence of other plugins or themes that provide a POP chain. If such a chain exists, attackers could perform destructive or unauthorized actions such as arbitrary file deletion, data disclosure, or code execution.

An attacker with administrator privileges can inject PHP objects via deserialization, potentially leading to high impact including confidentiality, integrity, and availability compromise. However, the vulnerability alone does not enable exploitation without an additional plugin or theme containing a POP chain. If a POP chain is present, the attacker could delete files, access sensitive information, or execute arbitrary code.

No official patch or fix has been confirmed yet. Administrators should monitor vendor advisories for updates. Since exploitation requires administrator access and a POP chain from other plugins or themes, limiting plugin/theme installations and reviewing installed components for known POP chains can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.