CVE-2026-75961 webaways CVE debrief

Who should care

Defenders responsible for WordPress installations with the NEX-Forms plugin should assess exposure and apply patches. Custom-level access and above users should be monitored for suspicious activity.

Why it matters

The SQL injection vulnerability in the NEX-Forms plugin allows authenticated attackers to extract sensitive information from the database, posing a risk to data confidentiality and potentially leading to further exploitation.

• Potential data breaches due to sensitive information extraction
• Increased risk of lateral movement within the network
• Need for verification of current exposure and patch application
• Potential for attackers to gain unauthorized access to database information

Technical summary

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin is vulnerable to SQL injection via the 'additional_params' parameter in versions up to and including 9.3.0. This allows authenticated attackers with custom-level access to append additional SQL queries and extract sensitive information from the database. The vulnerability is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The operator allowlist applied by get_table_records() when building its own WHERE fragment is not enforced on the same tainted additional_params array when it is forwarded to get_total_records(), leaving the SQL sink unprotected.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for the NEX-Forms plugin, focusing on custom-level access and above.

Recommended defensive actions

• Verify and apply the latest patches for the NEX-Forms plugin
• Restrict custom-level access and above to trusted users
• Monitor database queries for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in versions up to and including 9.3.0 of the NEX-Forms plugin. The CVE record and NVD entry provide details on the SQL injection vulnerability. Evidence is based on source-provided information and may not cover all affected scope or scenarios. Defenders should verify current exposure and apply patches, considering the potential for data breaches and lateral movement within the network.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.