What is the CVSS score of CVE-2026-7046?

CVE-2026-7046 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

NEX-Forms WordPress Plugin CVE-2026-7046

EUVD-2026-30518 MEDIUM

SQL Injection (CWE-89)

2026-05-15 Wordfence

GHSA-h922-vh43-3575

SQLi WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 09:31 vuln.today

CVE Published

May 15, 2026 - 07:46 nvd

MEDIUM 4.9

DescriptionCVE.org

The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'table' parameter in all versions up to, and including, 9.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based blind SQL injection in NEX-Forms Ultimate Forms Plugin for WordPress through version 9.1.12 allows authenticated administrators to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'table' parameter. The vulnerability requires administrator-level access and is not actively exploited in public records, but poses significant risk to multi-admin WordPress installations where admin accounts may be compromised or untrusted.

Technical ContextAI

NEX-Forms is a WordPress form builder plugin that constructs dynamic SQL queries to manage form data. The vulnerability exists in class.dashboard.php where the 'table' parameter is concatenated directly into SQL statements without proper escaping or prepared statement usage. CWE-89 (SQL Injection) occurs because user-supplied input is not sanitized before inclusion in SQL query construction. The affected code at lines 4220, 4224, and 4344 in class.dashboard.php demonstrates insufficient use of WordPress escaping functions (esc_sql) or parameterized queries. The CPE indicates all versions up to 9.1.12 are vulnerable, with version 9.1.13 referenced in repository tags suggesting a potential fix.

RemediationAI

Update NEX-Forms to version 9.1.13 or later immediately, as the repository tags suggest the patch was implemented in that release. Administrators should navigate to Plugins > Installed Plugins in WordPress, locate NEX-Forms, and click 'Update' if available. If version 9.1.13 is not yet released, apply a temporary workaround by restricting administrator role assignment to only fully trusted users, implementing IP whitelisting at the web server or WAF level to limit administrative access, and disabling the NEX-Forms plugin entirely if its form functionality is not actively required. Additionally, review WordPress user accounts with administrator privileges and remove any unnecessary admin role assignments. Monitor database logs for suspicious SQL patterns (multiple UNION statements, time-delay functions like SLEEP or BENCHMARK in the 'table' parameter) that may indicate exploitation attempts. Sites using the plugin should also review recent database activity and user access logs for evidence of compromise, particularly checking for unauthorized data exports or modifications through the plugin's dashboard.