NEX-Forms WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure exists in the NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress, affecting all versions through 8.8.1. The issue arises from inadequate directory listing prevention and the absence of file name randomization, enabling unauthenticated attackers to access sensitive data, including files uploaded through forms.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, including files uploaded via forms, potentially exposing personal data or other confidential information.

Remediation

Users are advised to update the NEX-Forms WordPress plugin to version 8.8.2 or a newer patched version.