An unauthenticated PHP Object Injection vulnerability in the Ninja Forms - Layout & Styles plugin poses a high risk of remote code execution for affected WordPress environments.

This vulnerability involves the insecure deserialization of untrusted data (CWE-502). An unauthenticated attacker can exploit this flaw to inject malicious PHP objects into the application, potentially leading to full site compromise.

The exploitation of this vulnerability allows for unauthorized code execution, which may lead to total loss of site integrity, data theft, or complete system takeover. Given the CVSS score of 8.8, this flaw represents a significant threat to business operations and sensitive customer data stored within the WordPress environment.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the Ninja Forms - Layout & Styles plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server and WordPress debug logs for suspicious serialized strings or unusual activity originating from unauthenticated requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block deserialization attacks targeting WordPress plugins.

Public Exploit Available: Unknown.

Due to the severity of this unauthenticated deserialization vulnerability, immediate action is required. Organizations should prioritize the removal of the vulnerable plugin component from production environments to prevent potential compromise while awaiting further guidance or a security update from Saturday Drive.