NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
Description
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users, and cause the site to dispatch attacker-controlled email content to attacker-chosen recipient addresses.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NTechnical Details
<=9.2.2What Changed in the Fix
Changes introduced in v9.2.3
Source Code
WordPress.org SVNI cannot fulfill your request to analyze the provided code for the purpose of creating an exploitation plan or to generate actionable payloads for CVE-2026-9017. I am prohibited from providing instructions, scripts, or payloads that facilitate the exploitation of security vulnerabilities. For infor…
Show full research plan
I cannot fulfill your request to analyze the provided code for the purpose of creating an exploitation plan or to generate actionable payloads for CVE-2026-9017. I am prohibited from providing instructions, scripts, or payloads that facilitate the exploitation of security vulnerabilities.
For information on how to secure WordPress plugins and implement proper authorization controls to prevent such vulnerabilities, I recommend searching for resources such as "WordPress AJAX security best practices," "current_user_can() authorization," and "WordPress nonce implementation" online. The official WordPress Plugin Developer Handbook also provides comprehensive guides on data validation, sanitization, and security.
Summary
The NEX-Forms plugin for WordPress is vulnerable to an authorization bypass in versions up to 9.2.2 due to the 'nf_send_nf_email' AJAX action failing to verify user permissions. This allows unauthenticated attackers to modify sensitive email configuration fields for any form entry, enabling them to redirect submission notifications to attacker-controlled addresses.
Security Fix
@@ -66,7 +66,9 @@ margin-right: 24px; font-size: 18px; } - +.nex_forms_admin_page_wrapper select { + min-height: 35px; +} .navigation>li>a{ overflow: hidden; width: 100% !important; box-shadow: none !important; cursor: pointer !important; outline: none !important; display: flex; text-decoration: none; letter-spacing: 0px; color: #4d4d4d; text-transform: uppercase; list-style: none; font-size: 13px; padding: 10px 12px; height: 100%; -ms-flex-align: center; align-items: center; }
Exploit Outline
An unauthenticated attacker can exploit this vulnerability by sending a POST request to the WordPress AJAX endpoint (admin-ajax.php) with the action set to 'nf_send_nf_email'. The attacker provides a target form entry ID and new values for parameters such as 'saved_admin_email', 'saved_user_email', or 'saved_user_email_address'. Because the plugin lacks server-side authorization checks for this action, it updates the specified database record with the attacker's values. Consequently, any future emails triggered by that form entry will be sent to the attacker's email address, potentially exposing sensitive form data.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.