CVE-2025-10185 Overview
CVE-2025-10185 is a SQL injection vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress. The flaw affects all versions up to and including 9.1.6. It resides in the nf_load_form_entries action, where the orderby parameter is not sufficiently escaped and the underlying SQL query lacks proper preparation. Authenticated attackers with Administrator-level access can append arbitrary SQL to existing queries and extract sensitive data from the WordPress database. Site administrators who grant elevated capabilities to lower-privileged roles may inadvertently expose the same attack surface to those users. The issue is tracked under CWE-89.
Critical Impact
Authenticated administrators can execute arbitrary SQL against the WordPress database, enabling extraction of user credentials, session tokens, and form submission data.
Affected Products
- NEX-Forms – Ultimate Forms Plugin for WordPress, versions up to and including 9.1.6
- WordPress sites using the vulnerable class.db.php component
- Environments where non-administrator roles were granted elevated form-management capabilities
Discovery Timeline
- 2025-10-11 - CVE-2025-10185 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10185
Vulnerability Analysis
The vulnerability originates in the NEX-Forms plugin's database class file class.db.php, specifically in the code path handling the nf_load_form_entries AJAX action. When a user requests form entries, the plugin accepts an orderby parameter to control result sorting. That parameter is inserted into the SQL statement without adequate escaping, and the surrounding query is not built using a prepared statement with bound parameters.
Because the ORDER BY clause cannot be parameterized in the same way as a value in a WHERE clause, developers must apply an allowlist of column names. The plugin failed to enforce such an allowlist, allowing attacker-controlled SQL fragments to reach the database engine. Successful exploitation lets the attacker append UNION SELECT statements or subqueries to read data from any table accessible to the WordPress database user, including wp_users and wp_usermeta.
Root Cause
The root cause is a classic instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The orderby value is concatenated into the query string with no sanitization against a known-good column set and without use of $wpdb->prepare() for the remainder of the statement.
Attack Vector
Exploitation requires an authenticated session with Administrator-level privileges. The attacker issues an authenticated request to the nf_load_form_entries endpoint with a crafted orderby value containing SQL syntax. The injected fragment is executed in the context of the WordPress database user, returning attacker-controlled data through the entries response. The attack is network-reachable and requires no user interaction. Full technical details are documented in the Wordfence Vulnerability Report and the upstream fix is visible in the WordPress Change Log Entry.
No verified public exploit code is available. See the vulnerable class file reference for the pre-patch code path.
Detection Methods for CVE-2025-10185
Indicators of Compromise
- Unexpected POST requests to admin-ajax.php with action=nf_load_form_entries containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the orderby parameter
- Anomalous read activity against wp_users, wp_usermeta, or wp_options tables originating from the WordPress database user
- Administrator sessions performing entry-loading requests at unusual volumes or time windows
Detection Strategies
- Deploy WordPress-aware web application firewall (WAF) rules that inspect the orderby parameter for characters outside an allowlist of column identifiers
- Enable MySQL general query logging or slow query logging temporarily during triage to capture crafted ORDER BY clauses
- Correlate authenticated administrator activity with database query patterns to surface injection attempts
Monitoring Recommendations
- Alert on any occurrence of SQL metacharacters in the orderby parameter of nf_load_form_entries requests
- Monitor the NEX-Forms plugin version across your WordPress estate and flag hosts running 9.1.6 or earlier
- Baseline expected administrator API usage and generate alerts for deviations that align with data-exfiltration patterns
How to Mitigate CVE-2025-10185
Immediate Actions Required
- Upgrade the NEX-Forms – Ultimate Forms Plugin to a version later than 9.1.6 on every WordPress site
- Audit which roles hold Administrator-level or delegated form-management capabilities and revoke unnecessary access
- Rotate credentials, API keys, and session secrets stored in the WordPress database if compromise is suspected
Patch Information
The vendor addressed the flaw in the plugin trunk after version 9.1.6. Review the applied fix in the WordPress Change Log Entry. Update through the WordPress plugin manager or via WP-CLI to receive the corrected class.db.php implementation.
Workarounds
- Restrict access to the WordPress admin dashboard using IP allowlists or VPN-only access
- Deploy a WAF rule that blocks requests to nf_load_form_entries when orderby contains anything other than known column identifiers
- Temporarily disable the NEX-Forms plugin on sites that cannot be patched immediately
# Update NEX-Forms via WP-CLI
wp plugin update nex-forms-express-wp-form-builder
# Verify installed version is greater than 9.1.6
wp plugin get nex-forms-express-wp-form-builder --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
