PHP Object Injection Vulnerability in Ninja Forms Plugin by Ninja Squad
CVE-2025-9083
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 18 September 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-9083?
The Ninja Forms plugin for WordPress, before version 3.11.1, contains a vulnerability that allows unauthenticated users to exploit PHP Object Injection through unserialization of user input in form fields. If the blog contains a suitable gadget, this flaw could be leveraged, potentially resulting in serious security breaches.
Affected Version(s)
Ninja Forms 0 < 3.11.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.