CVE-2016-1209: Ninja Forms WordPress plugin PHP object injection via POST

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and very high EPSS probability make this an urgent patch.

What it is

The Ninja Forms plugin before 2.9.42.1 for WordPress fails to properly validate input, allowing PHP object injection through crafted serialized values in a POST request. This is a critical, remotely reachable flaw in a widely deployed plugin, and public exploit code exists.

Impact

An attacker can inject arbitrary PHP objects, which can lead to remote code execution or full site compromise. Given the CVSS vector, confidentiality, integrity and availability impacts are all high.

Attack surface

Reached over the network via a POST request to the vulnerable plugin; the CVSS vector shows no privileges or user interaction required (PR:N, UI:N). No authentication is needed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.616, 99.1st percentile) and multiple references are tagged Exploit, including Packet Storm and a Rapid7 Metasploit module, indicating public exploitation tooling.

What to do

• Update Ninja Forms to version 2.9.42.1 or later immediately.
• If patching is not possible, disable or remove the Ninja Forms plugin until it can be updated.
• Restrict or monitor POST requests to WordPress plugin endpoints, especially those handling serialized data.
• Apply a web application firewall rule to block serialized object payloads in POST bodies to Ninja Forms paths.
• Audit the site for signs of compromise and rotate credentials if exploitation is suspected.

Detection

• Search web server logs for POST requests to Ninja Forms endpoints containing serialized PHP object strings (e.g., 'O:' patterns).
• Monitor for unexpected file creation or modification in WordPress upload and plugin directories.
• Use the Rapid7 Metasploit module signature or similar IDS rules to detect exploitation attempts.
• Review WordPress audit logs for unusual POST activity from unauthenticated clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.