NEX-Forms WordPress Plugin SQL Injection Vulnerability for Authenticated Administrators

A time-based blind SQL injection vulnerability has been identified in the NEX-Forms – Ultimate Forms Plugin for WordPress, affecting all versions through 9.1.12. The vulnerability arises from inadequate escaping of user-supplied data in the 'table' parameter, coupled with insufficient preparation of the SQL query. This flaw allows authenticated attackers with administrator-level access to inject additional SQL commands into existing queries, potentially leading to the extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for time-based blind SQL injection, where an attacker can manipulate SQL queries to extract data from the database. In this case, the vulnerability could be used to access sensitive information.

Remediation

Users are advised to update the NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.1.13 or a newer patched version.