CVE-2026-15602

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.5

Description This is a second-order SQL Injection issue where an attacker can append additional SQL queries to existing ones to extract sensitive database information. The flaw exists due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. The payload is stored via the submission report2 AJAX handler, which lacks a nonce check (a security token used to prevent cross-site request forgery) and relies on a capability that can be configured as low as the subscriber level. The injection is subsequently triggered when a CSV export is generated. The vulnerable parameter is additional params.

Recommendations Update NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.2.5 or later.