Description

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order vulnerability; the payload is stored via the submission_report2 AJAX handler (which lacks a nonce check and relies solely on a capability that can be configured down to subscriber-level) and triggered when a CSV export is generated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-16T05:16:47.140Z",
  "pubdate": "2026-08-16T05:16:47.140Z",
  "executiveSummary": "The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter affecting all versions up to, and including, 9.2.4. This vulnerability arises from insufficient escaping on the user-supplied parameter and a lack of proper query preparation in existing SQL statements.\nThe flaw allows authenticated attackers with administrative-level access or lower—depending on configurable capabilities—to append arbitrary SQL commands to existing queries. This enables the extraction of sensitive database information.\nThe issue manifests as a second-order SQL injection. Payloads are initially stored via the submission_report2 AJAX handler, which fails to implement a cryptographic nonce check and relies solely on capability checks that can be misconfigured down to the subscriber level.\nThe stored payload is subsequently triggered and executed when an administrator or privileged user generates a CSV export containing the malicious data.\nThe primary risk implication is unauthorized data exfiltrated from the underlying database, potentially compromising the integrity and confidentiality of the entire WordPress installation.",
  "technicalDetails": "The vulnerability resides in the NEX-Forms – Ultimate Forms Plugin for WordPress for all versions up to, and including, 9.2.4. The vulnerable component involves the handling of user-supplied data within the 'additional_params' parameter and its interaction with the database via the submission_report2 AJAX handler.\nThe root cause is twofold: insufficient input sanitization and escaping of the 'additional_params' parameter, combined with a lack of proper SQL query preparation. Instead of using parameterized queries or placeholders, the application improperly concatenates or interpolates the untrusted data directly into the database query structure.\nExploitation requires a multi-step, second-order attack flow. In the first phase, an authenticated attacker sends a request to the submission_report2 AJAX handler. This handler processes and stores the user-supplied input contained in the 'additional_params' parameter into the database. Notably, the submission_report2 AJAX handler suffers from a missing cryptographic nonce check and relies solely on an overly permissive capability check, which can be improperly configured to allow access down to subscriber-level users.\nIn the second phase of the attack flow, the malicious payload remains dormant in the database until a CSV export operation is initiated. When the CSV export is generated, the stored malicious string from 'additional_params' is retrieved and concatenated into an active SQL query without adequate escaping or parameterization.\nThis execution leads to a generic SQL Injection condition. The attacker is capable of appending arbitrary SQL commands to the existing query structure. The post-exploitation impact includes the potential extraction of sensitive database contents, such as user credentials, configuration data, and other restricted information stored within the WordPress database.\nNetwork exposure is restricted to authenticated users capable of interacting with the WordPress AJAX endpoints, although privilege requirements can be effectively reduced to subscriber level if capability configurations are mismanaged by administrators."
}