We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

NEX-Forms – Ultimate Forms Plugin for WordPress (CVE-2026-7046)

Nick Paliughi
On this page

Security Alert Summary

The NEX-Forms – Ultimate Forms Plugin for WordPress contains a time-based blind SQL injection vulnerability in the table parameter. Authenticated users with administrator-level privileges can inject additional SQL into existing queries due to insufficient escaping and lack of proper query preparation, which can be used to extract sensitive information from the database.

CVE Details

  • CVE ID: CVE-2026-7046
  • Affected plugin / component: NEX-Forms – Ultimate Forms Plugin for WordPress
  • Affected versions: all versions up to and including 9.1.12
  • Published: May 15, 2026, 9:16 AM UTC
  • Last modified: May 15, 2026, 2:09 PM UTC
  • CVSS v3.1: Base score 4.9, MEDIUM; vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
  • Authentication / privileges / user interaction: Requires authenticated attacker with high privileges (administrator-level); no user interaction required.
  • Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
  • Weakness: CWE-89 (SQL Injection)

Technical Details

This vulnerability is a time-based blind SQL injection triggered by the table parameter. User-supplied input is not sufficiently escaped and the existing SQL query is not adequately prepared, which allows an attacker with administrator-level access to append additional SQL statements into an existing query. Successful exploitation can be used to extract sensitive data from the database using time-based techniques.

The insecure code paths referenced in the advisory point to includes/classes/class.dashboard.php (see References). The issue stems from improper handling of the table parameter and missing or insufficient parameterization and escaping before the SQL is executed.

How This Could Impact Your Website

On a multi-user WordPress site, an administrator account could be used by the site owner, an internal staff member, or an external contractor. If an authenticated administrator account is compromised or misused, an attacker could use this SQL injection to query the database and obtain sensitive information such as user records and stored data. Practical consequences include disclosure of internal user email addresses and other data that can increase the risk of targeted phishing or social engineering against staff and contributors.

If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially accounts with administrator privileges and contributor roles.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and database access for unusual behavior or unexpected queries.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Quick Playground Plugin Vulnerability (CVE-2026-6403)
Next Post
WPGraphQL Plugin Vulnerability (CVE-2021-47959)