{"api_version":"1","generated_at":"2026-04-26T16:03:37+00:00","cve":"CVE-2022-3142","urls":{"html":"https://cve.report/CVE-2022-3142","api":"https://cve.report/api/cve/CVE-2022-3142.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-3142","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-3142"},"summary":{"title":"CVE-2022-3142","description":"The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.","state":"PUBLIC","assigner":"contact@wpscan.com","published_at":"2022-09-19 14:15:00","updated_at":"2023-11-07 03:50:00"},"problem_types":["CWE-89"],"metrics":[],"references":[{"url":"https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5","name":"https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5","refsource":"","tags":[],"title":"Authenticated SQL injection vulnerability in “NEX Forms” Wordpress plugin | by Elias Hohl | Medium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328","name":"https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328","refsource":"MISC","tags":[],"title":"NEX-Forms < 7.9.7 - Authenticated SQLi WordPress Security Vulnerability","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html","name":"http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html","refsource":"MISC","tags":[],"title":"WordPress NEX-Forms SQL Injection ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://medium.com/@elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5","name":"https://medium.com/@elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5","refsource":"MISC","tags":[],"title":"Authenticated SQL injection vulnerability in “NEX Forms” Wordpress plugin | by Elias Hohl | Aug, 2022 | Medium","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3142","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3142","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Elias Hohl","lang":""}],"nvd_cpes":[{"cve_year":"2022","cve_id":"3142","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"basixonline","cpe5":"nex-forms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ID":"CVE-2022-3142","ASSIGNER":"contact@wpscan.com","STATE":"PUBLIC","TITLE":"NEX-Forms < 7.9.7 - Authenticated SQLi"},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","generator":"WPScan CVE Generator","affects":{"vendor":{"vendor_data":[{"vendor_name":"Unknown","product":{"product_data":[{"product_name":"NEX-Forms – Ultimate Form Builder – Contact forms and much more","version":{"version_data":[{"version_affected":"<","version_name":"7.9.7","version_value":"7.9.7"}]}}]}}]}},"description":{"description_data":[{"lang":"eng","value":"The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings."}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://medium.com/@elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5","name":"https://medium.com/@elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5"},{"refsource":"MISC","url":"https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328","name":"https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328"},{"refsource":"MISC","name":"http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html","url":"http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html"}]},"problemtype":{"problemtype_data":[{"description":[{"value":"CWE-89 SQL Injection","lang":"eng"}]}]},"credit":[{"lang":"eng","value":"Elias Hohl"}],"source":{"discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2022-09-19 14:15:00","lastModifiedDate":"2023-11-07 03:50:00","problem_types":["CWE-89"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:basixonline:nex-forms:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"7.9.7","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}