CVE-2025-9260

🗓️ 04 Sep 2025 23:31:35Reported by redhat.comType

Fluent Forms deserialization vulnerability allows authenticated subscribers to inject objects; may read files and enable remote code execution; fix version is 6.1.2.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-9260	3 Sep 202503:32	–	circl
CNNVD	WordPress plugin Fluent Forms 代码问题漏洞	3 Sep 202500:00	–	cnnvd
CVE	CVE-2025-9260	2 Sep 202523:22	–	cve
Cvelist	CVE-2025-9260 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read	2 Sep 202523:22	–	cvelist
EUVD	EUVD-2025-26623	3 Oct 202520:07	–	euvd
NVD	CVE-2025-9260	3 Sep 202500:15	–	nvd
Patchstack	WordPress FluentForm plugin 5.1.16-6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read	2 Sep 202522:05	–	patchstack
Positive Technologies	PT-2025-35641	2 Sep 202500:00	–	ptsecurity
Vulnrichment	CVE-2025-9260 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read	2 Sep 202523:22	–	vulnrichment
Wordfence Blog	600,000 WordPress Sites Affected by PHP Object Injection Vulnerability in Fluent Forms WordPress Plugin	8 Sep 202515:38	–	wordfence

Source	Link
cve	www.cve.org/CVERecord

04 Sep 2025 23:31Current

7.4High risk

Vulners AI Score7.4

CVSS 3.16.5

EPSS0.00704

SSVC