Authorization Flaw in NEX-Forms WordPress Plugin Allows Unauthorized Modification of Form Entries
CVE-2026-106166
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-106166?
The NEX-Forms plugin for WordPress versions prior to 9.3.1 has a significant authorization flaw, lacking essential checks for validating user ownership and requests when updating stored form entries. This vulnerability enables unauthenticated attackers to exploit the system by modifying, deleting, or appending data to existing form submissions simply by utilizing the corresponding sequential identifier. Without stringent authorization, the integrity of submitted data is compromised, posing a serious risk to form data security.
Affected Version(s)
NEX-Forms 9.2.1 < 9.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.