CVE-2026-75961 webaways CVE debrief

Who should care

Defenders responsible for WordPress installations using the NEX-Forms – Ultimate Forms Plugin, particularly those with custom-level access users, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-75961 is a SQL Injection vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress, allowing authenticated attackers to potentially extract sensitive information from the database. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations, particularly for systems with custom-level access users, and consider applying patches or workarounds.

• Potential extraction of sensitive information from the database
• Increased risk of data breaches for affected systems
• Need for verification of plugin version and exposure
• Prioritization of patching or applying workarounds

Technical summary

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to SQL Injection via the 'additional_params' parameter. This allows authenticated attackers with custom-level access and above to append additional SQL queries into existing queries, potentially extracting sensitive information from the database. The issue arises from insufficient escaping of the 'additional_params' parameter and a lack of preparation on existing SQL queries.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure, particularly for systems with custom-level access users.

Recommended defensive actions

• Verify the presence of the vulnerable plugin version in your WordPress installation
• Assess exposure, particularly for systems with custom-level access users
• Consider applying patches or workarounds provided by the vendor
• Monitor for potential SQL injection attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in versions up to and including 9.3.0 of the NEX-Forms – Ultimate Forms Plugin for WordPress. The issue arises from insufficient escaping of the 'additional_params' parameter and a lack of preparation on existing SQL queries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.