CVE-2025-10185

Vulnerability

The NEX-Forms plugin for WordPress is vulnerable to SQL injection in all versions up to 9.1.6 via the 'orderby' parameter in the nf_load_form_entries action. The issue stems from insufficient escaping on the user-supplied parameter and lack of prepared statements in the SQL query, allowing attackers to inject malicious SQL.

Exploitation

Exploitation requires authentication with Administrator-level access. However, lower-level users may exploit this if a site administrator grants them access to the affected functionality. The attacker provides a crafted 'orderby' parameter that alters the SQL query's structure, enabling the injection of additional SQL commands.

Impact

An authenticated attacker with sufficient privileges can append SQL queries to existing ones, potentially extracting sensitive information from the WordPress database, such as user credentials or private data. This can lead to further compromise of the site.

Mitigation

As of the publication date, no patch has been released; all versions up to 9.1.6 are affected. Site administrators should limit access to the plugin's functionality and consider disabling the plugin until a fix is available. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

References: [1] Plugin source code showing the vulnerable SQL query construction.