CVE-2026-15602 describes a SQL Injection vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress affecting all versions up to 9.2.4. The flaw arises from improper neutralization of special elements in the 'additional_params' parameter, allowing authenticated users with admin-level access or higher to append malicious SQL queries. The vulnerability is second-order: malicious input is stored via the submission_report2 AJAX handler, which does not implement nonce checks and relies on configurable capabilities that can be lowered to subscriber level. The injected SQL is executed when a CSV export is generated, potentially exposing sensitive database information. No official patch or remediation level is provided in the available data.

An authenticated attacker with admin-level or higher privileges can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure (no integrity or availability impact reported). The second-order nature means the attack requires storing malicious input first and then triggering it during CSV export generation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's administrative functions to trusted users only and monitor for suspicious activity related to CSV exports. Consider disabling or restricting the submission_report2 AJAX handler if possible. Avoid lowering capability requirements for this handler to subscriber level or less.