PT-2026-25529
CVE-2026-1947
·
Publicado
2026-03-14
·
Atualizado
2026-03-17
Descrição por
CVSS 3.1
7.5
AltaMétricasAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
NEX-Forms – Ultimate Forms Plugin for WordPress versions through 9.1.9
Description
The NEX-Forms – Ultimate Forms Plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to a lack of validation on a user-controlled key within the
submit nex form() function. This allows unauthenticated attackers to overwrite arbitrary form entries by manipulating the nf set entry update id parameter.Recommendations
Update NEX-Forms – Ultimate Forms Plugin for WordPress to a version later than 9.1.9.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾