NEX-Forms CVE-2025-10185

Requires an authenticated WordPress session with Administrator-level capability (PR:H) to reach the nf_load_form_entries AJAX action, where the 'orderby' parameter is insufficiently escaped and the SQL query is not properly prepared, in NEX-Forms versions up to and including 9.1.6. The limiting factor is the high privilege barrier: in a standard single-administrator site the attacker would already have equivalent database access, so meaningful risk arises mainly in multi-tenant or delegated-role configurations where a site admin grants the required capability to a lower-trust user. No user interaction and no special non-default plugin configuration beyond the plugin being installed are needed.

This is a high-CVSS-component (C:H) but genuinely low-real-risk finding. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) requires Administrator-level privileges (PR:H), which is the dominant mitigating factor: an attacker who already holds WordPress admin can typically read the database through legitimate means (and often achieve code execution via plugin/theme editing), so this SQLi adds little incremental capability in a default single-admin deployment. The realistic threat surface is multi-tenant or role-delegated sites where a site owner grants near-admin access to lower-trust users, as the description explicitly notes ('may be exploitable by lower-level users if access is granted'). Exploitation signals are weak and consistent: EPSS is 0.32% (22nd percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit identified at time of analysis. No signals conflict here - low EPSS, no KEV, no POC, and high required privilege all point the same direction. Priority should be routine patching, not emergency response.

An attacker with Administrator-level access (or a lower-privilege user explicitly granted the capability on a multi-tenant site) submits a request to the nf_load_form_entries action with a malicious 'orderby' value, appending SQL to the existing query to exfiltrate credentials, hashes, or other sensitive data from the WordPress database. No public exploit code was identified at time of analysis, and the authentication barrier makes opportunistic mass-exploitation impractical.