Executive brief
NEX-Forms is a popular WordPress plugin used to build and manage custom forms on websites. A security flaw allows an authenticated user with administrator privileges to perform unauthorized database queries. This could lead to the exposure of sensitive information stored in the website's database, though it requires high-level access to exploit.
Technical details
The NEX-Forms plugin for WordPress is vulnerable to time-based blind SQL Injection due to insufficient escaping of the 'table' parameter and a lack of SQL query preparation in the class.dashboard.php file. An authenticated attacker with administrator-level permissions can exploit this by appending malicious SQL commands to existing queries. This vulnerability allows for the extraction of sensitive data from the database through time-based inference. The issue is addressed in version 9.1.13.
Affected products
- NEX-Forms NEX-Forms – Ultimate Forms Plugin for WordPress Up to, and including, 9.1.12
Timeline
- 2026-05-15: disclosed
- 2026-05-15: advisory
References
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/includes/classes/class.dashboard.php
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/includes/classes/class.dashboard.php
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/includes/classes/class.dashboard.php
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.13/includes/classes/class.dashboard.php
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.9/includes/classes/class.dashboard.php
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.9/includes/classes/class.dashboard.php
- https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.9/includes/classes/class.dashboard.php