Unauthorized Data Disclosure and Modification in NEX-Forms Plugin for WordPress
CVE-2020-36670
6.3MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 7 March 2023
Summary
The NEX-Forms plugin for WordPress has a vulnerability that allows authenticated attackers, even those with minimal permissions (subscriber level), to exploit missing capability checks on certain AJAX actions. This can lead to unauthorized data manipulation, including the ability to modify form submission records, delete files, send test emails, and alter plugin settings. Such flaws underline the need for robust authentication and careful management of user permissions to prevent misuse.
Affected Version(s)
NEX-Forms – Ultimate Form Builder – Contact forms and much more * <= 7.7.1
References
CVSS V3.1
Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Chloe Chamberland