The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the nf_load_form_entries action. This lack of proper escaping allows an attacker who is authenticated with administrator-level privileges to append arbitrary SQL statements to the existing query. The vulnerability is a classic SQL Injection flaw, identified as CWE‑89, and can be used to exfiltrate sensitive data from the database.

The flaw impacts the Webaways NEX‑Forms – Ultimate Forms Plugin for WordPress versions 9.1.6 and earlier (including 9.1.6). Users who have installed or run these affected releases are at risk if they have administrator or higher-level accounts on the site.

With a CVSS score of 4.9 the vulnerability is of moderate severity, and its EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires authenticated access, typically an administrator or privileged user; a site manager could grant lower‑level users the necessary permissions, widening the attack surface. Consequently, while the impact could be significant for an attacker able to log in, the likelihood of exploitation remains comparatively low.