CVE-2026-1947

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions through 9.1.9

Description The NEX-Forms – Ultimate Forms Plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to a lack of validation on a user-controlled key within the submit nex form() function. This allows unauthenticated attackers to overwrite arbitrary form entries by manipulating the nf set entry update id parameter.

Recommendations Update NEX-Forms – Ultimate Forms Plugin for WordPress to a version later than 9.1.9.