Unauthorized Data Disclosure and Modification in NEX-Forms Plugin for WordPress
CVE-2020-36670
6.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 7 March 2023
What is CVE-2020-36670?
The NEX-Forms plugin for WordPress has a vulnerability that allows authenticated attackers, even those with minimal permissions (subscriber level), to exploit missing capability checks on certain AJAX actions. This can lead to unauthorized data manipulation, including the ability to modify form submission records, delete files, send test emails, and alter plugin settings. Such flaws underline the need for robust authentication and careful management of user permissions to prevent misuse.
Affected Version(s)
NEX-Forms – Ultimate Form Builder – Contact forms and much more * <= 7.7.1