NEX-Forms WordPress Plugin Missing Authorization Vulnerability in License Deactivation

A vulnerability exists in the NEX-Forms – Ultimate Forms Plugin for WordPress, affecting all versions through 9.1.9. The issue arises from a missing capability check in the deactivate_license() function, allowing authenticated attackers with Subscriber-level access or higher to deactivate the plugin license. This unauthorized modification of data could disrupt the functionality of the plugin for users or site administrators.

Impact

Exploitation of this vulnerability allows for unauthorized deactivation of the plugin license, which could disrupt plugin functionality and access to premium features or updates.

Remediation

Users are advised to update the NEX-Forms – Ultimate Forms Plugin for WordPress to version 9.1.10 or a newer patched version.