EUVD-2026-100883
GHSA-wp3w-fh35-w7pm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate WordPress site running NEX-Forms
-
ExploitEnumerate sequential form-entry IDs
-
ExecutionSend unauthenticated entry-update request
-
ImpactOverwrite, erase or reassign stored entries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special configuration is required: the flaw is present in default installations of NEX-Forms because the plugin performs no authorization, ownership, or request-validation check before updating a stored entry. The only real prerequisites are that the target site runs an affected version (9.2.1 up to, but not including, 9.3.1) and that form entries already exist to be referenced. Exploitation is further eased - not limited - by the use of sequential entry identifiers, which makes target IDs trivially enumerable. Limiting factors are minimal: no authentication (PR:N) and no user interaction (UI:N) are needed, and impact is confined to stored form-submission data rather than the underlying WordPress host. |
| Impact | Signals here are mixed and point to a genuine-but-moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which is consistent with the description's 'unauthenticated attackers' claim and with CWE-639 (authorization bypass via user-controlled key / IDOR). However the base score is only 5.3 because NVD scored impact as integrity-only (I:L, C:N, A:N). That under-represents the description, which explicitly includes 'permanently erase' - a data-availability impact the NVD vector omits; verify scope with the vendor/WPScan. SSVC reinforces moderate priority: Exploitation=none (no observed active exploitation), Automatable=yes (sequential IDs make enumeration trivial to script), Technical Impact=partial. EPSS is low (0.16%, 5th percentile) and the CVE is NOT on CISA KEV, so there is no evidence of widespread or active exploitation. Public exploit code exists (WPScan), which distinguishes this from a purely theoretical issue, but POC availability is a separate signal from active exploitation and should not be conflated. Net: a real, easily-automatable data-tampering flaw worth patching promptly, but not an emergency - the ceiling is manipulation/destruction of stored form submissions, not system compromise. |
| Exploit ScenarioDerived | Because no ownership or authorization check is performed, a remote unauthenticated attacker scripts requests against the NEX-Forms entry-update endpoint, iterating sequential entry identifiers. Public exploit code exists (WPScan), and with AV:N/AC:L/PR:N/UI:N the attacker needs no credentials, no user interaction, and only a reachable WordPress site to overwrite, erase, reassign, or append to any stored form submission. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
NEX-Forms WordPress plugin versions 9.2.1 up to (but not including) 9.3.1 fail to perform any authorization, ownership, or request-validation check before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign, or append to any previously submitted entry by simply referencing its sequential identifier. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); publicly available exploit code exists, though CISA SSVC records no observed exploitation and EPSS is low at 0.16% (5th percentile), so this is a genuine but moderate-priority issue. Impact is confined to stored form-submission data - integrity and availability are rated Low, with no confidentiality loss and no compromise of the underlying WordPress host.
RemediationAI
Vendor-released patch: upgrade NEX-Forms to 9.3.1 or later - this is the only complete fix, since the vulnerability is the absence of an authorization/ownership/nonce check in the entry-update handler (see the WPScan advisory at https://wpscan.com/vulnerability/aa33ce05-091d-4fef-b875-4fedb8b8fc9d/). If immediate upgrading is not possible, the most effective compensating control is to deactivate the NEX-Forms plugin until patched, accepting the loss of all form functionality; a less disruptive alternative is to export and then purge stored entries so there are no enumerable records to tamper with, at the cost of losing submission history and potentially breaking workflows that depend on it. Because exploitation is unauthenticated and the identifiers are sequential, WAF or rate-limiting rules that block rapid sequential requests to the plugin's entry-update endpoint can raise the effort bar, but this is a detection/deterrence measure with false-positive risk for legitimate high-volume traffic and should not be treated as a substitute for patching. Sites should also review existing form entries for unexpected overwrites, deletions, or reassignments using the WPScan advisory and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-106166) as references, since tampering may already have occurred before remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key), the classic Insecure Direct Object Reference pattern, in the WordPress form-builder plugin NEX-Forms. Entry update requests are dispatched without verifying that the caller owns the entry, is authenticated at all, or submitted a valid nonce/CSRF token, so the entry identifier supplied by the client is trusted as the sole selector for the record being modified. Because NEX-Forms assigns sequential IDs to stored submissions, an attacker can trivially enumerate valid keys rather than guess them, which lowers the effort required even though the assessed impact remains partial. The operation targets the plugin's own entry-storage layer (WordPress database tables managed by NEX-Forms) rather than WordPress core, so the blast radius is limited to captured form data; the CPE record is incomplete (cpe:2.3:a:unknown:nex-forms:*:*:*:*:*:*:*:*), reflecting that the vendor/product mapping was not normalized, but the EUVD affected-version data confirms the NEX-Forms 9.2.1 < 9.3.1 range.
Know when Nex Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network IDOR (PR:N/AV:N/AC:L); I:L for tampering/appending entries and A:L added because the description allows permanent erasure, which the NVD vector omits; no data disclosure so C:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL stat
Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation. Rated high severity (CVSS 7.5),
Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports. Rated high severity (CVSS 7.5), this
The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user i
Stored Cross-Site Scripting in the NEX-Forms WordPress plugin before version 9.2.3 allows unauthenticated remote attacke
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputt
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms ne
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms -
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms ne
Reflected cross-site scripting in the Basix NEX-Forms WordPress plugin (through version 9.3.1) allows remote attackers t
Stored cross-site scripting in Basix NEX-Forms (WordPress form-builder plugin) affects all versions up to and including
Exploit-DB