SQL Injection Vulnerability in NEX-Forms Plugin for WordPress

CVE-2024-10862

Summary

An SQL injection vulnerability has been discovered in the NEX-Forms - Ultimate Form Builder plugin for WordPress, affecting all versions up to and including 8.7.13. This vulnerability arises due to inadequate escaping mechanisms for user-supplied input in the 'search_params' parameter, coupled with insufficient safeguards in the existing SQL query structure. As a result, unauthorized attackers are able to inject additional SQL commands, potentially leading to the extraction of sensitive database information. Furthermore, the absence of proper nonce validation on the get_table_records AJAX action heightens the risk of CSRF exploits, allowing attackers to perform unauthorized actions without user consent.

References