PT-2025-35641 · WordPress · Fluent Forms

Craig Smith · Published 2025-09-02 · Updated 2025-09-03 · CVE-2025-9260

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress versions 5.1.16 through 6.1.1

Description The plugin is susceptible to PHP Object Injection due to deserialization of untrusted input within the parseUserProperties function. Authenticated attackers with Subscriber-level access or higher can inject a PHP Object. The presence of a PHP Object Payload (POP) chain enables attackers to read arbitrary files. If allow url include is enabled on the server, remote code execution is possible.

Recommendations Update to version 6.1.2 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-9260

Affected Products

Fluent Forms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9260 · Security Note
• https://t.me/CVEtracker/31539 · Telegram Post
• https://twitter.com/CVEnew/status/1963023330396500155 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/938e5d6b-1ad6-4021-a148-1d1c9e8a0a83?source=cve · Note
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.0.2/app/Services/FormBuilder/EditorShortcodeParser.php#L214 · Note
• https://plugins.trac.wordpress.org/browser/fluentform/tags/6.0.2/vendor/wpfluent/framework/src/WPFluent/View/View.php#L7 · Note