CVE-2025-4208

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the get_table_records function. This is due to the unsanitized use of user-supplied input in call_user_func(). This makes it possible for authenticated attackers, with Custom-level access, to execute arbitrary PHP functions that meet specific constraints (static methods or global functions accepting a single array parameter).

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php?rev=3226607#L3420	Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2b7215-d3a7-4e5a-ae9b-65fecc26dceb?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:basixonline:nex-forms:*:*:*:*:*:wordpress:*:*

History

04 Jun 2025, 22:58

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-08 12:15

Updated : 2025-06-04 22:58

NVD link : CVE-2025-4208

Mitre link : CVE-2025-4208

CVE.ORG link : CVE-2025-4208

JSON object : View

Products Affected

basixonline

nex-forms

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-4208", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2025-05-08T12:15:18.217", "references": [{"url": "https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.dashboard.php?rev=3226607#L3420", "tags": ["Product"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d2b7215-d3a7-4e5a-ae9b-65fecc26dceb?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the get_table_records function. This is due to the unsanitized use of user-supplied input in call_user_func(). This makes it possible for authenticated attackers, with Custom-level access, to execute arbitrary PHP functions that meet specific constraints (static methods or global functions accepting a single array parameter)."}, {"lang": "es", "value": "El complemento NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more para WordPress es vulnerable a la ejecuci\u00f3n limitada de c\u00f3digo en todas las versiones hasta la 8.9.1 incluida, a trav\u00e9s de la funci\u00f3n get_table_records. Esto se debe al uso no autorizado de la entrada proporcionada por el usuario en call_user_func(). Esto permite a atacantes autenticados, con acceso de nivel personalizado, ejecutar funciones PHP arbitrarias que cumplen restricciones espec\u00edficas (m\u00e9todos est\u00e1ticos o funciones globales que aceptan un \u00fanico par\u00e1metro de matriz)."}], "lastModified": "2025-06-04T22:58:48.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:basixonline:nex-forms:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "F7FB445A-51C8-42B9-B7D1-F8BC5B2FAAE0", "versionEndIncluding": "8.9.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}