CVE-2025-10185 is an SQL Injection vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress. The issue arises from insufficient escaping of the 'orderby' parameter in the nf_load_form_entries action, allowing authenticated users with high privileges to append malicious SQL queries. This can lead to unauthorized disclosure of sensitive data from the database. The vulnerability affects all plugin versions up to 9.1.6. Exploitation requires at least administrator-level access, though lower-level users might exploit it if granted access by an administrator. No patch or remediation details have been provided by the vendor.

An authenticated attacker with Administrator-level privileges can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact availability or integrity according to the CVSS vector, but it compromises confidentiality. Lower-privileged users may exploit it if given sufficient access by administrators. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative functions to trusted users only. Review and limit user privileges to prevent unauthorized access. Monitor for vendor updates and apply patches promptly once available.