NEX-Forms WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Unauthenticated Arbitrary Form Entry Modification

A vulnerability exists in the NEX-Forms – Ultimate Forms Plugin for WordPress, in all versions through 9.1.9. The issue is an Insecure Direct Object Reference (IDOR) that allows unauthenticated users to overwrite arbitrary form entries. This vulnerability arises from the submit_nex_form() function, which lacks proper validation on a user-controlled key. Exploitation is possible through the 'nf_set_entry_update_id' parameter.

Impact

Exploitation of this vulnerability allows for unauthorized modification of form entries, potentially leading to data integrity issues.

Remediation

Users are advised to update the NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.1.10 or a newer patched version.