PHP Object Injection in Ninja Forms Submission CSV Export

Unauthenticated attackers can submit serialized PHP data in form fields that Ninja Forms unserializes when an administrator exports submissions to CSV. If a suitable POP chain exists in another installed plugin or theme, this can lead to arbitrary file operations or remote code execution. Sites running Ninja Forms 3.15.3 and earlier are affected.

This vulnerability affects the following application versions:

• Ninja Forms – The Contact Form Builder 3.6.34
• Ninja Forms – The Contact Form Builder 3.6.34.1
• Ninja Forms – The Contact Form Builder 3.7.3
• Ninja Forms – The Contact Form Builder 3.7.3.1
• Ninja Forms – The Contact Form Builder 3.8.0
• Ninja Forms – The Contact Form Builder 3.8.1
• Ninja Forms – The Contact Form Builder 3.8.2
• Ninja Forms – The Contact Form Builder 3.8.3
• Ninja Forms – The Contact Form Builder 3.8.4
• Ninja Forms – The Contact Form Builder 3.8.5
• Ninja Forms – The Contact Form Builder 3.8.6
• Ninja Forms – The Contact Form Builder 3.8.7
• Ninja Forms – The Contact Form Builder 3.8.8
• Ninja Forms – The Contact Form Builder 3.8.9
• Ninja Forms – The Contact Form Builder 3.8.10
• Ninja Forms – The Contact Form Builder 3.8.11
• Ninja Forms – The Contact Form Builder 3.8.12
• Ninja Forms – The Contact Form Builder 3.8.13
• Ninja Forms – The Contact Form Builder 3.8.14
• Ninja Forms – The Contact Form Builder 3.8.15
• Ninja Forms – The Contact Form Builder 3.8.16
• Ninja Forms – The Contact Form Builder 3.8.17
• Ninja Forms – The Contact Form Builder 3.8.18
• Ninja Forms – The Contact Form Builder 3.8.19
• Ninja Forms – The Contact Form Builder 3.8.20
• Ninja Forms – The Contact Form Builder 3.8.21
• Ninja Forms – The Contact Form Builder 3.8.22
• Ninja Forms – The Contact Form Builder 3.8.23
• Ninja Forms – The Contact Form Builder 3.8.24
• Ninja Forms – The Contact Form Builder 3.8.25
• Ninja Forms – The Contact Form Builder 3.8.25.1
• Ninja Forms – The Contact Form Builder 3.9.0
• Ninja Forms – The Contact Form Builder 3.9.1
• Ninja Forms – The Contact Form Builder 3.9.2
• Ninja Forms – The Contact Form Builder 3.9.2.1
• Ninja Forms – The Contact Form Builder 3.10.0
• Ninja Forms – The Contact Form Builder 3.10.1
• Ninja Forms – The Contact Form Builder 3.10.2
• Ninja Forms – The Contact Form Builder 3.10.2.1
• Ninja Forms – The Contact Form Builder 3.10.2.2
• Ninja Forms – The Contact Form Builder 3.10.3
• Ninja Forms – The Contact Form Builder 3.10.4
• Ninja Forms – The Contact Form Builder 3.10.4.1
• Ninja Forms – The Contact Form Builder 3.11.0
• Ninja Forms – The Contact Form Builder 3.11.1
• Ninja Forms – The Contact Form Builder 3.11.1.1
• Ninja Forms – The Contact Form Builder 3.12.0
• Ninja Forms – The Contact Form Builder 3.12.1
• Ninja Forms – The Contact Form Builder 3.12.2
• Ninja Forms – The Contact Form Builder 3.12.2.1
• Ninja Forms – The Contact Form Builder 3.13.0
• Ninja Forms – The Contact Form Builder 3.13.1
• Ninja Forms – The Contact Form Builder 3.13.2
• Ninja Forms – The Contact Form Builder 3.13.3
• Ninja Forms – The Contact Form Builder 3.13.4
• Ninja Forms – The Contact Form Builder 3.14.0
• Ninja Forms – The Contact Form Builder 3.14.1
• Ninja Forms – The Contact Form Builder 3.14.2
• Ninja Forms – The Contact Form Builder 3.14.3
• Ninja Forms – The Contact Form Builder 3.14.4
• Ninja Forms – The Contact Form Builder 3.14.5
• Ninja Forms – The Contact Form Builder 3.14.6
• Ninja Forms – The Contact Form Builder 3.14.7
• Ninja Forms – The Contact Form Builder 3.14.8
• Ninja Forms – The Contact Form Builder 3.14.9
• Ninja Forms – The Contact Form Builder 3.14.10
• Ninja Forms – The Contact Form Builder 3.14.11
• Ninja Forms – The Contact Form Builder 3.14.12
• Ninja Forms – The Contact Form Builder 3.15.0
• Ninja Forms – The Contact Form Builder 3.15.1
• Ninja Forms – The Contact Form Builder 3.15.2
• Ninja Forms – The Contact Form Builder 3.15.3