CVE-2026-1948

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions up to and including 9.1.9

Description The NEX-Forms – Ultimate Forms Plugin for WordPress plugin is susceptible to unauthorized data modification. This is due to a missing capability check within the deactivate license() function. Authenticated attackers with Subscriber-level access or higher can exploit this to deactivate the plugin license.

Recommendations Update to a version beyond 9.1.9.