Unauthorized Data Disclosure and Modification in NEX-Forms Plugin for WordPress
CVE-2020-36670

6.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Nex-forms – Ultimate Form Builder – Contact Forms And Much More
Vendor
CVE Published:
7 March 2023

What is CVE-2020-36670?

The NEX-Forms plugin for WordPress has a vulnerability that allows authenticated attackers, even those with minimal permissions (subscriber level), to exploit missing capability checks on certain AJAX actions. This can lead to unauthorized data manipulation, including the ability to modify form submission records, delete files, send test emails, and alter plugin settings. Such flaws underline the need for robust authentication and careful management of user permissions to prevent misuse.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

NEX-Forms – Ultimate Form Builder – Contact forms and much more * <= 7.7.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/2427162/

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chloe Chamberland
JSON
.