PT-2019-7411 · Nexforms · Nex-Forms-Express-Wp-Form-Builder

Published 2019-10-07 · Updated 2025-01-15 · CVE-2015-9452

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nex-forms-express-wp-form-builder plugin versions prior to 4.6.1

Description The issue is related to SQL injection via the "wp-admin/admin.php?page=nex-forms-main" API endpoint, specifically through the nex forms Id parameter. This allows for potential exploitation.

Recommendations For versions prior to 4.6.1, update to version 4.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "wp-admin/admin.php?page=nex-forms-main" API endpoint to minimize the risk of exploitation. Avoid using the nex forms Id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2015-9452

Affected Products

Nex-Forms-Express-Wp-Form-Builder

References · 7

• 🔥 http://cinu.pl/research/wp-plugins/mail_cb24b6204803e8e94943b198edc37af7.html · Exploit
• 🔥 https://wpvulndb.com/vulnerabilities/8336 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9452 · Security Note
• https://t.me/cibsecurity/7270 · Telegram Post
• https://wordpress.org/plugins/nex-forms-express-wp-form-builder/#developers · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9452 · Note
• https://t.me/cvenotify/107530 · Telegram Post