Unauthorized Data Modification in NEX-Forms – Ultimate Forms Plugin for WordPress

CVE-2026-1948

What is CVE-2026-1948?

The NEX-Forms – Ultimate Forms Plugin for WordPress suffers from a security flaw that allows unauthorized data modification. This is due to a missing capability check in the deactivate_license() function, affecting all versions up to and including 9.1.9. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to deactivate the plugin's license, potentially disrupting service and access for legitimate users. It is crucial for WordPress users employing this plugin to take immediate action to secure their installations and mitigate this risk.

References