9.8Kritisch

CVE-2025-9083Ninja-forms < 3.11.1 - Unauthenticated PHP Objection

Ninja Forms Veröffentlicht: 2025-09-18 09:00 (vor 1 Jahr)

Beschreibung

The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

Schwachstellentyp (CWE): CWE-502

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
ninjaforms	ninja forms	< 3.11.1
—	Ninja Forms	< 3.11.1

Referenzen und Patches

https://wpscan.com/vulnerability/60b4d7fc-5d23-4dcf-bd7f-e202cabc2625/ exploitvdb-entrytechnical-descriptionExploit

CPE-Treffer (NVD) (1)

cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:* < 3.11.1

CVSS-Score

9.8Kritisch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (2)

CISA-ADP	CVSS 3.1	9.8Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritisch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.54%

höher als 46 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: poc
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2025-08-15
Veröffentlicht2025-09-18 09:00
Bei IP-DB eingegangen2026-10-25 00:01
Zuletzt aktualisiert2026-06-17 13:08

Vergeben von (CNA): WPScan
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

Ohne Score

CVE-2026-110132 vor 5 Stunden

Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification

Sync Post With Other Site

The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, includ…

Ohne Score

CVE-2026-110963 vor 5 Stunden

Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

Userplace

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or …

Ohne Score

CVE-2026-104639 vor 5 Stunden

Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook

Razorpay for WooCommerce

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection…

Ohne Score

CVE-2026-105970 vor 5 Stunden

BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation

Thanh Toán Quét Mã QR Code Tự Động

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders…

Ohne Score

CVE-2026-106015 vor 5 Stunden

Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force

Ecommerce Affiliate

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including admin…

Ohne Score

CVE-2026-109925 vor 5 Stunden

Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

Productive Commerce

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.