CVE-2024-0907: NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the restorerecords() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to restore records.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0907?
CVE-2024-0907 has a medium severity level due to unauthorized access risks.
How do I fix CVE-2024-0907?
To fix CVE-2024-0907, update the NEX-Forms plugin to version 8.5.7 or later.
Who is affected by CVE-2024-0907?
All versions of the NEX-Forms plugin up to and including 8.5.6 are affected by CVE-2024-0907.
What does the CVE-2024-0907 vulnerability allow attackers to do?
CVE-2024-0907 allows authenticated attackers to gain unauthorized access through a missing capability check.
When was CVE-2024-0907 disclosed?
CVE-2024-0907 was disclosed in 2024, highlighting its impact on WordPress sites using the affected plugin.