CVE-2025-9083

Ninja-forms < 3.11.1 - Unauthenticated PHP Objection

9.8 Critical

CVE-2025-9083 is a critical vulnerability (CVSS 9.8) in Ninjaforms Ninja Forms, published September 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. No source names a fixed version.

The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.54%Up 0.5 points since Sep 18, 2025

What each source reports

CVE List Score used 9.8

Ninja-forms < 3.11.1 - Unauthenticated PHP Objection

Record: CVE-2025-9083
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-29844 9.8

Record: EUVD-2025-29844
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q88q-7pp2-q72v 9.8

The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which...

Record: GHSA-q88q-7pp2-q72v
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

NVD 9.8

Record: CVE-2025-9083
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

Affected products

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD