Executive brief
NEX-Forms is a popular WordPress plugin that allows website administrators to create and manage custom forms. An authenticated attacker with contributor-level or higher permissions can inject malicious SQL code through the additional_params parameter, potentially exposing sensitive data stored in the WordPress database such as user information, form submissions, and other confidential records.
Technical details
This vulnerability is a generic SQL injection flaw in the NEX-Forms plugin affecting versions up to 9.3.0. The root cause is insufficient escaping of the 'additional_params' user-supplied parameter combined with lack of parameterized queries. While the get_table_records() function applies an operator allowlist when building WHERE clauses, this validation is not enforced when the same tainted 'additional_params' array is passed to get_total_records(), leaving a SQL sink unprotected. The vulnerability requires authentication with custom-level access or above, and allows attackers to append arbitrary SQL queries to extract sensitive information from the database. A patch is available in version 9.3.1 or later.
Affected products
- NEX-Forms NEX-Forms – Ultimate Forms Plugin up to and including 9.3.0
Timeline
- 2026-09-18: disclosed