CVE-2025-4208: Basixonline Nex-forms RCE Vulnerability

CVE-2025-4208 Overview

CVE-2025-4208 affects the NEX-Forms – Ultimate Form Builder plugin for WordPress in all versions up to and including 8.9.1. The flaw resides in the get_table_records function, which passes unsanitized user input into PHP's call_user_func(). Authenticated attackers holding Custom-level access can invoke arbitrary PHP functions that meet specific constraints, namely static methods or global functions that accept a single array parameter. The issue is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated users with Custom-level access can execute a constrained set of arbitrary PHP functions on the underlying WordPress host, enabling data exposure and further compromise.

Affected Products

Basixonline NEX-Forms – Ultimate Form Builder plugin for WordPress
All versions up to and including 8.9.1
WordPress installations exposing the plugin's dashboard endpoints to authenticated users

Discovery Timeline

2025-05-08 - CVE-2025-4208 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4208

Vulnerability Analysis

The NEX-Forms plugin exposes a get_table_records handler in class.dashboard.php used by the plugin's dashboard reporting functions. The handler forwards attacker-controlled input into call_user_func() without sanitization or an allowlist. Because call_user_func() treats its first argument as a callable, the plugin effectively lets a Custom-level user pick which PHP function runs.

Exploitation is constrained by the callable signature. The attacker can only invoke callables that accept a single array parameter, such as global functions or static class methods matching that shape. Even with that constraint, the attack surface within core PHP and WordPress is large enough to enable information disclosure, integrity impact, and limited availability impact on the site.

The vulnerability requires authentication at the Custom role level, which reduces the pool of eligible attackers but is realistic in multi-author sites, membership platforms, and environments where custom roles are broadly granted.

Root Cause

The root cause is unsanitized use of user-supplied input as the callable argument to call_user_func() inside get_table_records. The plugin does not validate the callable against an allowlist and does not filter out sensitive PHP or WordPress functions. See the WordPress Plugin Class File for the vulnerable code location.

Attack Vector

The attack originates over the network against the WordPress admin AJAX or dashboard endpoints served by the plugin. An authenticated user with Custom-level privileges submits a request that supplies both the callable name and the single-array argument consumed by get_table_records. The plugin dispatches the callable through call_user_func(), executing the attacker-chosen PHP function within the WordPress request context.

Because no verified public exploit is currently indexed, no proof-of-concept code is included here. See the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2025-4208

Indicators of Compromise

POST requests to WordPress admin-ajax or plugin dashboard endpoints referencing the get_table_records action from non-administrator accounts.
Unexpected PHP function names appearing as parameter values in request bodies targeting NEX-Forms endpoints.
New or modified files under wp-content/uploads/ or plugin directories following requests to the NEX-Forms dashboard handler.
Outbound network connections initiated by the PHP worker process shortly after NEX-Forms AJAX activity.

Detection Strategies

Enable WordPress request logging and alert on action=get_table_records invocations tied to non-privileged roles.
Deploy a web application firewall rule that inspects NEX-Forms request parameters for known dangerous PHP function names.
Correlate authentication events for Custom-role users with immediately subsequent plugin AJAX activity to surface abuse patterns.

Monitoring Recommendations

Monitor the installed version of the nex-forms-express-wp-form-builder plugin across all WordPress sites and flag any version at or below 8.9.1.
Track PHP error and access logs for anomalous callable dispatch failures originating from the plugin's dashboard code path.
Baseline normal usage of NEX-Forms reporting features so deviations in parameter shape or frequency are easier to identify.

How to Mitigate CVE-2025-4208

Immediate Actions Required

Update NEX-Forms – Ultimate Form Builder to a version later than 8.9.1 as soon as a patched release is available from the vendor.
Audit WordPress user accounts and revoke Custom-level privileges from users who do not require them.
Review recent request logs against NEX-Forms endpoints for evidence of call_user_func abuse and investigate any anomalies.
Rotate credentials and API keys reachable from the WordPress process if exploitation is suspected.

Patch Information

No vendor advisory URL is listed in the CVE record at publication time. Site administrators should consult the plugin's changelog on WordPress.org and the Wordfence Vulnerability Report for the fixed version and upgrade instructions.

Workarounds

Disable the NEX-Forms plugin until a patched version is installed if Custom-role users cannot be restricted.
Restrict access to wp-admin/admin-ajax.php for non-administrator sessions using a web application firewall or reverse proxy rule.
Remove the Custom role or downgrade affected users to a role without access to the NEX-Forms dashboard endpoints.

bash

# Example: disable the plugin from the command line using WP-CLI
wp plugin deactivate nex-forms-express-wp-form-builder
wp plugin status nex-forms-express-wp-form-builder