SQL Injection Vulnerability in NEX-Forms Plugin for WordPress

CVE-2026-15602

What is CVE-2026-15602?

The NEX-Forms – Ultimate Forms Plugin for WordPress has a vulnerability that allows authenticated users with admin-level access to exploit SQL Injection via the 'additional_params' parameter. This flaw arises from inadequate escaping of user-supplied data and insufficient preparation of existing SQL queries. Attackers can inject additional SQL commands, leading to potential extraction of sensitive database information. The vulnerability is categorized as a second-order SQL injection, where the payload is stored through the submission_report2 AJAX handler, which lacks necessary nonce checks, allowing its execution during CSV export processes.

References