CVE-2026-106166
NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
| Vendor | unknown |
| Product | nex-forms |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown nex-forms
Be the first to know when new unknown vulnerabilities affecting unknown nex-forms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / NEX-Forms
9.2.1 < 9.3.1
References
Credits
Farid Narimanov WPScan