CVE-2022-3142
NEX-Forms < 7.9.7 - Authenticated SQLi
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Record
CVE-2022-3142- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
NEX-Forms < 7.9.7 - Authenticated SQLi
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Record
CVE-2022-3142- Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2022-42569 No score
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Record
EUVD-2022-42569- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5www-q64q-vx68
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input...
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Record
GHSA-5www-q64q-vx68- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi | 2023-03-25 |
| Nuclei | NEX-Forms Plugin < 7.9.7 - SQL Injection |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3142 is a high vulnerability (CVSS 8.8) in Basixonline Nex-forms, published September 19, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.6%, the 96th percentile. No source names a fixed version.
References
medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5
wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328
packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html
nvd.nist.gov/vuln/detail/CVE-2022-3142
github.com/advisories/GHSA-5www-q64q-vx68