CVE-2025-9083: Ninja-forms < 3.11.1 - Unauthenticated PHP Objection
Published Sep 18, 2025
·Updated
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Affected Software
2 affected components
Ninja Forms Ninja Forms<3.11.1
NinjaForms Ninja Forms Wordpress<3.11.1
Event History
Sep 18, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Feb 28, 57989
Event
via FIRST·04:48 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-9083?
CVE-2025-9083 has been classified as a high-severity vulnerability due to its potential for PHP Object Injection.
2
How do I fix CVE-2025-9083?
To fix CVE-2025-9083, this vulnerability can be mitigated by updating the Ninja Forms plugin to version 3.11.1 or later.
3
Who is affected by CVE-2025-9083?
CVE-2025-9083 affects all versions of the Ninja Forms plugin prior to version 3.11.1.
4
What type of attack can be executed due to CVE-2025-9083?
CVE-2025-9083 allows unauthenticated users to exploit PHP Object Injection through malicious user input.
5
Is authentication required to exploit CVE-2025-9083?
No, CVE-2025-9083 can be exploited by unauthenticated users, making it particularly dangerous.