Cross-Site Request Forgery Vulnerability in NEX-Forms by Basix

CVE-2025-49399

What is CVE-2025-49399?

A Cross-Site Request Forgery vulnerability exists in the NEX-Forms plugin developed by Basix, which can enable unauthorized actions to be performed on behalf of authenticated users. This affects versions 9.1.3 and prior, potentially compromising the security of WordPress sites that utilize this plugin. Attackers may exploit this vulnerability to execute malicious commands, posing a significant risk to user data and site integrity. It is advisable for users to update to the latest version and implement security measures to safeguard their applications.

References