[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frqVmU41St8tBq5Yk9TeyKMeArDHA5nYtX-ZuPv21J_E":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-9017","nex-forms-missing-authorization-to-unauthenticated-arbitrary-form-entry-modification-via-nfsendnfemail-ajax-action","NEX-Forms \u003C= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action","The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users, and cause the site to dispatch attacker-controlled email content to attacker-chosen recipient addresses.","nex-forms-express-wp-form-builder",null,"\u003C=9.2.2","9.2.3","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-10 17:40:45","2026-07-11 06:50:32",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F0af9df66-8d82-4ae8-85a1-656d8ea40a7a?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002Fcss\u002Fdashboard.css","admin\u002Fjs\u002Fbuilder.js","admin\u002Fjs\u002Fdashboard.js","includes\u002Fclasses\u002Fclass.dashboard.php","includes\u002Fclasses\u002Fclass.db.php","includes\u002Fclasses\u002Fclass.functions.php","includes\u002Fclasses\u002Fclass.install.php","main.php","researched",false,3,"I cannot fulfill your request to analyze the provided code for the purpose of creating an exploitation plan or to generate actionable payloads for CVE-2026-9017. I am prohibited from providing instructions, scripts, or payloads that facilitate the exploitation of security vulnerabilities.\n\nFor information on how to secure WordPress plugins and implement proper authorization controls to prevent such vulnerabilities, I recommend searching for resources such as \"WordPress AJAX security best practices,\" \"current_user_can() authorization,\" and \"WordPress nonce implementation\" online. The official WordPress Plugin Developer Handbook also provides comprehensive guides on data validation, sanitization, and security.","The NEX-Forms plugin for WordPress is vulnerable to an authorization bypass in versions up to 9.2.2 due to the 'nf_send_nf_email' AJAX action failing to verify user permissions. This allows unauthenticated attackers to modify sensitive email configuration fields for any form entry, enabling them to redirect submission notifications to attacker-controlled addresses.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnex-forms-express-wp-form-builder\u002F9.2.2\u002Fadmin\u002Fcss\u002Fdashboard.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnex-forms-express-wp-form-builder\u002F9.2.3\u002Fadmin\u002Fcss\u002Fdashboard.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnex-forms-express-wp-form-builder\u002F9.2.2\u002Fadmin\u002Fcss\u002Fdashboard.css\t2026-06-05 07:42:40.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnex-forms-express-wp-form-builder\u002F9.2.3\u002Fadmin\u002Fcss\u002Fdashboard.css\t2026-06-24 09:33:26.000000000 +0000\n@@ -66,7 +66,9 @@\n \tmargin-right: 24px;\n \tfont-size: 18px;\n }\n-\n+.nex_forms_admin_page_wrapper select {\n+    min-height: 35px;\n+}\n .navigation>li>a{\n \toverflow: hidden;\n \twidth: 100% !important;\n\tbox-shadow: none !important;\n\tcursor: pointer !important;\n\toutline: none !important;\n\tdisplay: flex;\n\ttext-decoration: none;\n\tletter-spacing: 0px;\n\tcolor: #4d4d4d;\n\ttext-transform: uppercase;\n\tlist-style: none;\n\tfont-size: 13px;\n\tpadding: 10px 12px;\n\theight: 100%;\n\t-ms-flex-align: center;\n\talign-items: center;\n}","An unauthenticated attacker can exploit this vulnerability by sending a POST request to the WordPress AJAX endpoint (admin-ajax.php) with the action set to 'nf_send_nf_email'. The attacker provides a target form entry ID and new values for parameters such as 'saved_admin_email', 'saved_user_email', or 'saved_user_email_address'. Because the plugin lacks server-side authorization checks for this action, it updates the specified database record with the attacker's values. Consequently, any future emails triggered by that form entry will be sent to the attacker's email address, potentially exposing sensitive form data.","gemini-3-flash-preview","2026-07-15 08:09:32","2026-07-15 08:10:20",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","9.2.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnex-forms-express-wp-form-builder\u002Ftags\u002F9.2.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnex-forms-express-wp-form-builder.9.2.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnex-forms-express-wp-form-builder\u002Ftags\u002F9.2.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnex-forms-express-wp-form-builder.9.2.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnex-forms-express-wp-form-builder\u002Ftags"]