CVE-2024-13498: NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure
First published: Wed Mar 12 2025(Updated: )
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.8.1 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NEX-Forms – Ultimate Form Builder | <=8.8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-13498?
CVE-2024-13498 is classified as a medium severity vulnerability due to sensitive information exposure.
How do I fix CVE-2024-13498?
To fix CVE-2024-13498, update the NEX-Forms plugin to version 8.8.2 or later.
What types of sensitive information are exposed in CVE-2024-13498?
CVE-2024-13498 can expose sensitive information via file uploads that could be accessed without proper authorization.
Is CVE-2024-13498 specific to a certain platform?
Yes, CVE-2024-13498 specifically affects the NEX-Forms – Ultimate Form Builder plugin on WordPress.
What versions of the plugin are affected by CVE-2024-13498?
CVE-2024-13498 affects all versions of the NEX-Forms plugin up to and including version 8.8.1.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/nex-forms
- canonical/nex-forms – ultimate form builder