diff --git a/paranoia.module b/paranoia.module
index dde6c03..04299bc 100644
--- a/paranoia.module
+++ b/paranoia.module
@@ -237,3 +237,35 @@ function live_person_paranoia_hide_permissions() {
 function auto_entitylabel_paranoia_hide_permissions() {
   return array('use PHP for label patterns');
 }
+
+/**
+ * Implements hook_form_alter().
+ *
+ * Hides forms that allow php arrays for importing to avoid RCE.
+ * http://heine.familiedeelstra.com/security/unserialize
+ */
+function paranoia_form_alter(&$form, &$form_state, $form_id) {
+  $forms_to_disable = module_invoke_all('paranoia_risky_forms');
+  $forms_to_disable = drupal_map_assoc($forms_to_disable);
+  if (array_key_exists($form_id, $forms_to_disable)) {
+    $form['#access'] = FALSE;
+    $form['#validate'] = 'paranoia_form_validate_always_fail';
+    drupal_set_message(t('This form is disabled for security reasons. See <a href="https://www.drupal.org/node/2313945">details</a> on why this form is disabled.'), 'error');
+  }
+}
+
+/**
+ * Form validation that will always throw an error to prevent submits.
+ */
+function paranoia_form_validate_always_fail() {
+  form_set_error('', t('This form is disabled for security reasons. See <a href="https://www.drupal.org/node/2313945">details</a> on why this form is disabled.'));
+}
+
+/**
+ * Implements paranoia_risky_forms().
+ *
+ * On behalf of views module.
+ */
+function views_paranoia_risky_forms() {
+  return array('views_ui_import_page');
+}