CVE-2016-1209

CRITICAL 9.8CVE-2016-1209 · Published 14/05/2016 · updated 17/06/2026

In short

CVE-2016-1209 is a CRITICAL (CVSS 9.8) vulnerability affecting ninja forms (ninjaforms).
Chance of exploitation in the next 30 days (EPSS): 61.6%, higher than 99.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ninja forms ninjaforms	`≤ 2.9.42`	No fix yet

Description

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.

References

jvn.jp/en/jp/JVN44657371/index.html · Vendor Advisory
jvndb.jvn.jp/jvndb/JVNDB-2016-000064 · Vendor Advisory
packetstormsecurity.com/files/137211/WordPress-Ninja-Forms-Unauthenticated-File-Upload.html · Exploit
pritect.net/blog/ninja-forms-2-9-42-critical-security-vulnerabilities
rapid7.com/db/modules/exploit/unix/webapp/wp_ninja_forms_unauthenticated_file_upload · Exploit
ninjaforms.com/important-security-update-always-hurt-ones-love
wordpress.org/plugins/ninja-forms/changelog
wpvulndb.com/vulnerabilities/8485

More vulnerabilities in ninja forms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ninja forms

ninjaforms

≤ 2.9.42

No fix yet

More vulnerabilities in ninja forms

See all →