What is the CVSS score of CVE-2026-1948?

CVE-2026-1948 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1948?

Organizations using all should be aware of moderate risk from CVE-2026-1948, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-1948?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-1948

EUVD-2026-12182 MEDIUM

Missing Authorization (CWE-862)

2026-03-14 Wordfence

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 04:00 euvd

EUVD-2026-12182

Analysis Generated

Mar 14, 2026 - 04:00 vuln.today

CVE Published

Mar 14, 2026 - 03:24 nvd

MEDIUM 4.3

DescriptionCVE.org

The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_license() function in all versions up to, and including, 9.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to to deactivate the plugin license.

AnalysisAI

The NEX-Forms Ultimate Forms Plugin for WordPress contains a missing capability check vulnerability in the deactivate_license() function, allowing authenticated attackers with Subscriber-level privileges to deactivate the plugin license without proper authorization. This authorization bypass affects all versions up to and including 9.1.9 and has a CVSS score of 4.3 (Low severity), indicating limited direct impact but meaningful privilege escalation concerns for multi-user WordPress installations.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization), a common flaw in WordPress plugin development where capability checks are not properly enforced before executing sensitive functions. The affected product is the NEX-Forms Ultimate Forms Plugin (CPE: cpe:2.3:a:webnexus:nex-forms), a widely deployed WordPress plugin for form creation and management. The deactivate_license() function should restrict execution to administrators or users with explicit license management capabilities, but lacks these checks entirely. This allows any authenticated user—including those with minimal Subscriber-level access—to interact with licensing functionality that should be reserved for higher-privileged roles. The vulnerability represents a failure in WordPress plugin security best practices, specifically the omission of the current_user_can() capability check that should gate the license deactivation logic.

RemediationAI

Immediately upgrade the NEX-Forms Ultimate Forms Plugin to the patched version released after 9.1.9. Visit the official WordPress plugin repository or the vendor's website to download and install the latest version, which includes the missing capability check in the deactivate_license() function. As an interim mitigation, WordPress administrators should restrict Subscriber-level role permissions by reviewing user accounts and reducing unnecessary Subscriber accounts, limiting access to trusted administrators only via the WordPress admin panel. Additionally, implement rate limiting and IP-based access controls on the WordPress admin login endpoint using plugins such as Wordfence or by configuring your web server. Monitor plugin license status regularly and enable email notifications for license-related changes if the plugin provides such functionality.