Login Request a demo
High severity · published Sep 19, 2022
CVE-2022-3142
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections
8.8
CVSS
14.6%
EPSS
No
On KEV
Description
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)14.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Nex-forms · Basixonline
before 7.9.7 · source: NVD
Affected product
NE
Nex-forms
Basixonline
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3142
packetstormsecurity.com
http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html
medium.com
https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5
Exploit
https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328
More from Nex-forms
9.8
CVE-2015-9452
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter
8.8
CVE-2023-52120
WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF)
7.5
CVE-2021-34676
Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation
7.5
CVE-2021-34675
Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports
7.2
CVE-2024-53808
WordPress NEX-Forms plugin <= 8.7.8 - SQL Injection vulnerability