CVE-2026-81772: CWE-502 Deserialization of Untrusted Data in Saturday Drive Ninja Forms - Layout & Styles

This vulnerability (CVE-2026-81772) affects the Saturday Drive Ninja Forms - Layout & Styles plugin versions up to 3.0.31. It is caused by unsafe deserialization of untrusted data, leading to unauthenticated PHP object injection. The vulnerability has a CVSS 3.1 score of 8.8, indicating a high risk with network attack vector, low complexity, no privileges required, but requiring user interaction. Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability.

The vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to arbitrary code execution. This can compromise the confidentiality, integrity, and availability of the affected system, making it a critical risk for users of the vulnerable plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Users should monitor the vendor's communications for updates and consider disabling or restricting access to the vulnerable plugin until a patch is available.