Sensitive Information Exposure in NEX-Forms Plugin for WordPress
CVE-2024-13498

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Nex-forms – Ultimate Form Builder – Contact Forms And Much More
Vendor
CVE Published:
12 March 2025

What is CVE-2024-13498?

The NEX-Forms – Ultimate Form Builder plugin for WordPress is prone to a vulnerability that exposes sensitive information. The flaw, present in all versions up to and including 8.8.1, arises from insufficient directory listing prevention and the absence of file name randomization for uploaded files. This allows unauthenticated attackers to access and potentially extract sensitive data, including files uploaded through forms, posing a significant risk to user security and privacy.

Affected Version(s)

NEX-Forms – Ultimate Form Builder – Contact forms and much more * <= 8.8.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3235420/nex-...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim Coen
.