CVE-2025-9083 Details
Description
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
A PHP Object Injection vulnerability has been identified in the Ninja Forms WordPress plugin, affecting versions prior to 3.11.1. The issue arises because the plugin unserializes user input from form fields, which could enable unauthenticated users to inject malicious objects, provided a suitable gadget is available on the blog.
Users are advised to update the Ninja Forms WordPress plugin to version 3.11.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/60b4d7fc-5d23-4dcf-bd7f-e202cabc2625/ | CISA-ADP | ExploitThird Party Advisory |
| https://wpscan.com/vulnerability/60b4d7fc-5d23-4dcf-bd7f-e202cabc2625/ | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ninjaforms ninja forms | < 3.11.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 23, 2025 | Initial Analysis | [email protected] |
| Sep 22, 2025 | CVE Modified | CISA-ADP |
| Sep 18, 2025 | New CVE Received | [email protected] |