CVE-2026-106166

NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.

Affected

NEX-Forms

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.23% chance of exploitation in the next 30 days, 13th percentile

Published

2026-10-14

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/aa33ce05-091d-4fef-b875-4fedb8b8fc9d/

References

• CVE Record
• NVD entry