CVE-2026-75961 is a SQL Injection vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress. The flaw exists in the 'additional_params' parameter, which is insufficiently escaped and inconsistently validated when forwarded to the get_total_records() function. This allows authenticated attackers with custom-level access or above to inject additional SQL commands into existing queries, enabling unauthorized extraction of sensitive data. The operator allowlist applied by get_table_records() is not enforced on the same parameter when used in get_total_records(), leaving the SQL sink unprotected. This affects all plugin versions up to and including 9.3.0.

An authenticated attacker with custom-level access or higher can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact availability or integrity but compromises confidentiality. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to the 'additional_params' parameter. Avoid using affected versions in production environments if possible.