Input validation vulnerability in NEX-Forms – Ultimate Forms Plugin for WordPress 9.1.6

The NEX-Forms plugin for WordPress has a security vulnerability that allows attackers to inject SQL commands through the ‘orderby’ parameter in the nf_load_form_entries action. This vulnerability affects all versions up to 9.1.6 and can be exploited by authenticated attackers with Administrator-level access or higher. This can lead to sensitive information being extracted from the database. Lower-level users may also be able to exploit this if granted access by a site administrator.