CVE-2024-13498: NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.8.1 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13498?
CVE-2024-13498 is classified as a medium severity vulnerability due to sensitive information exposure.
How do I fix CVE-2024-13498?
To fix CVE-2024-13498, update the NEX-Forms plugin to version 8.8.2 or later.
What types of sensitive information are exposed in CVE-2024-13498?
CVE-2024-13498 can expose sensitive information via file uploads that could be accessed without proper authorization.
Is CVE-2024-13498 specific to a certain platform?
Yes, CVE-2024-13498 specifically affects the NEX-Forms – Ultimate Form Builder plugin on WordPress.
What versions of the plugin are affected by CVE-2024-13498?
CVE-2024-13498 affects all versions of the NEX-Forms plugin up to and including version 8.8.1.