CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_license() function in all versions up to, and including, 9.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to to deactivate the plugin license.
Explanation of Vulnerability in Simple Terms
NEX-Forms versions 9.1.9 and earlier lack proper authorization checks, allowing authenticated users to modify form data they should not have access to. An attacker with a low-privilege WordPress account can alter form submissions or settings belonging to other users or forms. This affects the integrity of form data but does not expose sensitive information or take the site offline.
What an attacker can do
Modify form data or settings belonging to other users or forms.
Potential impact on your site
Form submissions and configurations may be altered by unauthorized users, compromising data integrity and form reliability.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account; no user interaction required.
Key dates
External resources
Related vulnerabilities
