The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wordpress |
|
No data.
No data.
References
History
Thu, 18 Sep 2025 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wordpress
Wordpress wordpress |
|
| Vendors & Products |
Wordpress
Wordpress wordpress |
Thu, 18 Sep 2025 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog. | |
| Title | Ninja-forms < 3.11.1 - Unauthenticated PHP Objection | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published: 2025-09-18T06:00:06.472Z
Updated: 2025-09-18T06:00:06.472Z
Reserved: 2025-08-15T16:14:23.525Z
Link: CVE-2025-9083
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2025-09-18T06:15:35.210
Modified: 2025-09-18T13:43:34.310
Link: CVE-2025-9083
Redhat
No data.