CVE-2026-75961

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.3.1

Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs because the additional params parameter is not sufficiently escaped and the SQL query is not properly prepared. Specifically, the operator allowlist used by the get table records() function when building its WHERE fragment is not enforced when the additional params array is forwarded to the get total records() function, leaving the SQL sink unprotected. This allows attackers to append additional SQL queries to extract sensitive information from the database.

Recommendations Update NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.3.1 or later. As a temporary mitigation, restrict access to the additional params parameter for users with custom-level permissions.