CVE-2024-10862 is an SQL Injection vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress affecting all versions up to 8.7.15. The issue is caused by improper neutralization of special elements in the 'search_params' parameter, allowing attackers to inject additional SQL queries. The lack of nonce validation on the get_table_records AJAX action enables exploitation via CSRF. The vulnerability can lead to unauthorized extraction of sensitive database information. The CVSS 3.1 base score is 4.9, reflecting a medium severity with network attack vector, low attack complexity, and high confidentiality impact but no integrity or availability impact. No patch or official fix has been documented yet.

An attacker can exploit this vulnerability to perform SQL Injection attacks that may disclose sensitive information from the database without authentication. The vulnerability also allows exploitation through CSRF due to missing nonce validation. There is no indication of integrity or availability impact. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable AJAX action if possible. Monitoring for updates from the vendor or security advisories is recommended. No vendor advisory or patch links are currently available.