Unauthorized Data Access in NEX-Forms Plugin for WordPress
CVE-2025-15510

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Nex-forms – Ultimate Forms Plugin For WordPress
Vendor
CVE Published:
31 January 2026

What is CVE-2025-15510?

The NEX-Forms – Ultimate Forms Plugin for WordPress has a critical vulnerability that allows unauthorized users to access and export form configurations. This issue arises from a missing capability check in the NF5_Export_Forms class constructor, present in all versions up to and including 9.1.8. Attackers can exploit this flaw by manipulating the nex_forms_Id parameter, potentially exposing sensitive information such as email addresses, PayPal API credentials, and integration keys with third-party services. It is essential for users of this plugin to review their installation and apply necessary security measures.

Affected Version(s)

NEX-Forms – Ultimate Forms Plugin for WordPress 0 <= 9.1.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/nex-forms-expr...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Deadbee
.