EUVD-2026-59851
GHSA-2vxx-wj9p-3c6m
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Admin-level credentials required to complete the full attack chain (CSV export trigger); confidentiality-only impact as injection yields read access with no write or availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order vulnerability; the payload is stored via the submission_report2 AJAX handler (which lacks a nonce check and relies solely on a capability that can be configured down to subscriber-level) and triggered when a CSV export is generated.
AnalysisAI
Second-order SQL injection in NEX-Forms - Ultimate Forms Plugin for WordPress (versions through 9.2.4) enables authenticated attackers with admin-level access to extract arbitrary data from the WordPress database by abusing insufficient escaping on the 'additional_params' parameter. The attack is staged: a malicious payload is first stored via the submission_report2 AJAX handler, which notably lacks a nonce check and whose required capability can be configured down to subscriber-level, then the injection fires when an administrator triggers a CSV export. No public exploit or active exploitation has been confirmed at time of analysis, but the privilege-downgrade path on the AJAX handler meaningfully complicates the PR:H framing of the official CVSS vector.
Technical ContextAI
NEX-Forms (vendor: webaways, CPE cpe:2.3:a:webaways:nex-forms_-_ultimate_forms_plugin_for_wordpress:*:*:*:*:*:*:*:*) is a WordPress form-builder plugin. The vulnerability is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) second-order injection. In first-order SQLi the payload is injected and executed in the same request; here, the payload is persisted to the database through the submission_report2 AJAX handler (main.php L3756/L3764) and the injection is not triggered until a separate code path in class.dashboard.php (L5481) constructs a SQL query incorporating the stored value during CSV export generation. The root cause is dual: the 'additional_params' value is not properly escaped or parameterized before being embedded in an existing SQL query, and the storage AJAX handler provides no nonce protection, relying solely on a WordPress capability check that site administrators can reassign to lower roles such as subscriber.
RemediationAI
A code-level fix has been committed to the WordPress plugin SVN repository (changeset 3644732 at plugins.trac.wordpress.org/changeset), but a specific patched release version number is not independently confirmed from the available data. Site owners should update NEX-Forms to the latest available version from the WordPress plugin repository immediately and verify it supersedes 9.2.4. As a compensating control pending upgrade, administrators should audit the capability assigned to the submission_report2 AJAX handler and ensure it is not delegated below administrator level, which reduces the payload-storage attack surface. Additionally, restricting direct database read permissions for the WordPress database user to the minimum required tables limits the data an attacker can extract even if injection succeeds. Disabling CSV export functionality entirely is a high-impact but disruptive workaround that eliminates the trigger path. No side effects are expected from restricting the AJAX handler capability beyond potentially blocking lower-privileged users from intended submission reporting features.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today