An unauthenticated attacker can call multiple methods in Ninja Forms class in order to inject objects to eventually perform Remote Code Execution(RCE).
Get through updates and upcoming events, and more directly in your inbox