CVE-2026-75961: NEX-Forms WordPress Plugin SQLi Vulnerability

CVE-2026-75961 Overview

CVE-2026-75961 is a SQL injection vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress. The flaw affects all versions up to and including 9.3.0. It resides in the handling of the additional_params parameter, which is forwarded to get_total_records() without the operator allowlist that get_table_records() applies when building its own WHERE fragment. Authenticated attackers with custom-level access or above can append SQL fragments to existing queries and extract sensitive database contents. The issue is tracked under CWE-89.

Critical Impact
Authenticated attackers with custom-level access can exfiltrate arbitrary database contents, including WordPress user records and session data, via crafted additional_params input.

Affected Products

NEX-Forms – Ultimate Forms Plugin for WordPress, all versions through 9.3.0
WordPress sites running the vulnerable plugin with custom-role or higher accounts provisioned
Multi-tenant hosting environments where low-privilege authors can be granted plugin access

Discovery Timeline

2026-09-18 - CVE-2026-75961 published to NVD
2026-09-19 - Last updated in NVD database

Technical Details for CVE-2026-75961

Vulnerability Analysis

The NEX-Forms plugin exposes a submissions dashboard that queries stored form entries through two paired helper functions in class.db.php. The get_table_records() function constructs a WHERE clause from the additional_params array and applies an operator allowlist to reject dangerous SQL operators. However, the same tainted additional_params array is also handed to get_total_records(), which builds its own SQL statement without applying the allowlist or preparing user-supplied fragments. The result is a SQL sink reachable by any authenticated user who can invoke the dashboard endpoints.

Because the query is composed by concatenating user-influenced strings rather than using $wpdb->prepare() with placeholders, an attacker can insert boolean, time-based, or UNION-style payloads. Extractable data typically includes the wp_users table (usernames, email addresses, hashed passwords) and any custom form submission tables that store personally identifiable information.

Root Cause

The root cause is inconsistent input validation across paired query builders. Sanitization applied in one code path (get_table_records()) is not mirrored in the sibling path (get_total_records()), leaving the count query unprotected. This is a classic instance of improper neutralization of special elements used in an SQL command (CWE-89).

Attack Vector

Exploitation requires authentication at a custom role level or above. The attacker submits a crafted request to a NEX-Forms dashboard endpoint that populates the additional_params array with SQL metacharacters and operators outside the allowlist. Because get_total_records() interpolates these values directly into its query, the injected fragment is executed by the MySQL backend. The vulnerability is network-reachable and does not require user interaction. Refer to the Wordfence Vulnerability Analysis and the Nex Forms DB Class Code for the sink location.

Detection Methods for CVE-2026-75961

Indicators of Compromise

HTTP requests to admin-ajax.php or NEX-Forms dashboard endpoints containing additional_params values with SQL keywords such as UNION, SLEEP(, BENCHMARK(, or --.
Unusual query execution latency in MySQL slow query logs correlated with NEX-Forms dashboard activity.
New or unexpected authenticated sessions from custom-role accounts accessing form submission data.

Detection Strategies

Deploy web application firewall rules that inspect additional_params[] array values for SQL metacharacters and operator injection patterns.
Enable MySQL general or audit logging on WordPress databases and alert on queries containing multiple SELECT statements originating from the NEX-Forms code path.
Review WordPress access logs for repeated dashboard requests from a single low-privilege user, which is characteristic of automated SQLi tooling.

Monitoring Recommendations

Baseline the volume of dashboard requests per authenticated role and alert on statistical outliers.
Correlate authentication events with subsequent NEX-Forms endpoint access to identify credential abuse.
Monitor for outbound data transfers from the web tier that follow successful dashboard queries, which can indicate exfiltration.

How to Mitigate CVE-2026-75961

Immediate Actions Required

Update the NEX-Forms – Ultimate Forms Plugin to a release later than 9.3.0 that includes the fix referenced in the Nex Forms Code Changeset.
Audit WordPress user accounts and revoke custom-role access from users who do not require form administration.
Rotate WordPress secret keys in wp-config.php and reset passwords for privileged accounts if exploitation is suspected.

Patch Information

The vendor addressed the flaw in a version released after 9.3.0. The upstream fix is visible in the Nex Forms Code Changeset. Administrators should apply the update through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

Disable the NEX-Forms plugin on production sites until the patched version is deployed.
Restrict access to wp-admin and admin-ajax.php via IP allowlisting at the reverse proxy or web application firewall.
Remove custom roles that were provisioned solely for form management until the update is applied.

bash

# Configuration example: WP-CLI plugin update and role audit
wp plugin update nex-forms-express-wp-form-builder
wp user list --role=custom_role --fields=ID,user_login,user_email
wp plugin deactivate nex-forms-express-wp-form-builder  # temporary workaround