critical CVSS 9.8

CVE-2025-9083·PHP vulnerability

The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

Severity
critical
Software
PHP
Fixed in
3.11.1
Published
2025-09-18

Affected versions

Until: 3.11.1

Fixed in: 3.11.1

How to fix this CVE

Update the Ninja Forms WordPress plugin to version 3.11.1 or later to eliminate the unsafe object deserialization vulnerability. This critical flaw allows unauthenticated attackers to inject malicious serialized PHP objects through form submissions, potentially leading to remote code execution if suitable gadget chains exist in your WordPress environment. Prioritize this update immediately given the CVSS 9.8 severity rating.

sudo dnf update php php-common php-cli php-fpm

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST requests to wp-admin/admin-ajax.php or form submission endpoints containing serialized PHP object patterns such as 'O:digits:"classname"' or 'a:digits:{...}' in request body, particularly in form field parameters

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement ModSecurity rules to block POST requests containing serialized PHP object patterns (regex: /O:\d+:"|unserialize/i) targeting WordPress form processing endpoints, and enforce strict content-type validation on form submissions

How to check if you are affected

  1. Check the installed Ninja Forms plugin version by navigating to WordPress Admin > Plugins and locating Ninja Forms; the current version is displayed in the plugin list
  2. Verify the plugin version via command line: grep -r 'Version:' /var/www/html/wp-content/plugins/ninja-forms/ninja-forms.php | head -1
  3. Search web server logs for POST requests to form processing endpoints with suspicious serialized data patterns: grep -i 'O:[0-9]' /var/log/apache2/access.log or /var/log/nginx/access.log
  4. Confirm the update was successful by verifying the plugin version shows 3.11.1 or higher in the WordPress admin panel

FAQ

What is CVE-2025-9083?

CVE-2025-9083 is a critical PHP object injection vulnerability in Ninja Forms plugin versions before 3.11.1. The plugin unsafely deserializes form field data without proper validation, allowing unauthenticated attackers to instantiate arbitrary PHP objects and potentially execute code if exploitable gadget chains are available.

Is CVE-2025-9083 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and there are no publicly available exploit proofs-of-concept. However, the critical CVSS 9.8 score and ease of exploitation make immediate patching essential.

What versions of Ninja Forms are affected by CVE-2025-9083?

All versions of Ninja Forms prior to 3.11.1 are vulnerable. The exact earliest affected version is unknown, but users should assume any version below 3.11.1 requires immediate updating.

How do I check if my server is vulnerable to CVE-2025-9083?

Log into your WordPress dashboard, navigate to Plugins, and check the Ninja Forms version number. If it shows any version below 3.11.1, your installation is vulnerable. Alternatively, run: curl -s https://yoursite.com/wp-content/plugins/ninja-forms/ninja-forms.php | grep Version

Does Defensia detect CVE-2025-9083?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Ninja Forms plugin is active on a monitored WordPress installation, CVE-2025-9083 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2026-28289CVSS 10FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-9083. Free for 1 server.

Get started free