CVE-2026-106166: NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NEX-Forms WordPress pluginto a version that resolves this vulnerability.Fixed in 9.3.1
Event History
Frequently Asked Questions
Which installations are affected?
Installations running the NEX-Forms WordPress plugin before version 9.3.1 are affected. The provided affected range specifically includes versions 9.2.1 through 9.2.5.
Does exploitation require a WordPress account or a valid form submission?
No. The issue is exploitable without authentication because the entry update operation lacks authorization, ownership, and request-validation checks. An attacker only needs to reference the sequential identifier of a previously submitted form entry.
What can an attacker do to existing form data?
An attacker can overwrite, permanently erase, reassign, or append data to previously submitted form entries. This can compromise the integrity and availability of stored form-submission records.
What should be prioritized if an immediate upgrade is not possible?
The provided information identifies no workaround or mitigation other than addressing the affected plugin version. Prioritize protecting the integrity of stored NEX-Forms entries and reviewing them for unexpected overwrites, deletions, reassignment, or appended content.