Cyber Resilience

CVE-2023-2114

HighPublic PoC

Published: 08 May 2023

Published
08 May 2023
Modified
04 February 2025
KEV Added
Patch
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.4590 97.7th percentile
Risk Priority 42 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-2114 is a high-severity SQL Injection (CWE-89) vulnerability in Basixonline Nex-Forms. Its CVSS base score is 7.2 (High).

Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The NEX-Forms WordPress plugin before version 8.4 is affected by an SQL injection vulnerability tracked as CVE-2023-2114. The root cause is insufficient escaping of the user-controlled `table` parameter before it is concatenated into an SQL query, corresponding to CWE-89. The issue received a CVSS 3.1 base score of 7.2 with a network attack vector and high-privilege requirement.

An authenticated administrator can supply a malicious `table` value to execute arbitrary SQL statements, resulting in full read, write, and delete access to the database and potential compromise of the confidentiality, integrity, and availability of the WordPress site.

Public references include a proof-of-concept repository and a WPScan entry that document the flaw and the affected versions. The EPSS score rose from lower values to a peak of 0.7569 on 2026-03-04 before receding to the current 0.4590, indicating a period of increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

basixonline
nex-forms
≤ 8.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References