The NEX-Forms – Ultimate Forms Plugin for WordPress contains a time‑based blind SQL injection in versions up to 9.1.12. The flaw stems from insufficient escaping of the 'table' parameter inside an existing SQL query, allowing an attacker who can authenticate with administrator‑level privileges to append arbitrary SQL statements to the query. This can be used to read sensitive data from the database and potentially alter or delete it. The vulnerability is classified as CWE-89, representing an injection flaw with the potential to compromise data confidentiality and integrity.

The affected product is Webaways’ NEX-Forms – Ultimate Forms Plugin for WordPress, specifically any installation running version 9.1.12 or earlier. No other vendors or products are listed as impacted.

The CVSS score of 4.9 indicates a medium level of severity, and the EPSS score is not available, suggesting current exploitation data is not documented. The vulnerability is not listed in the CISA KEV catalog, meaning no known public exploits are recorded. The attack vector requires an authenticated administrator or higher, which limits exposure to sites with weak account control. Nonetheless, any administrator account with access to the plugin could exploit the flaw to extract or modify data, making the risk significant for sites that keep the plugin at or below version 9.1.12.