CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.9 via the submit_nex_form() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to to overwrite arbitrary form entries via the 'nf_set_entry_update_id' parameter.
Explanation of Vulnerability in Simple Terms
NEX-Forms versions up to 9.1.9 contain an authorization bypass vulnerability that allows unauthenticated attackers to modify form data or settings over the network. The vulnerability requires no user interaction and affects the integrity of form submissions and configurations. Site administrators should update to a version newer than 9.1.9 immediately.
What an attacker can do
Modify form data, settings, or submissions without authentication.
Potential impact on your site
Form submissions and configurations can be altered by unauthorized parties, compromising data integrity.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
