CVE-2026-12404

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.2.3

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to enumerate sequential report IDs and download complete form submission data, which may include names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths for any saved report on the site.

Recommendations Update NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.2.3 or later.