CVE-2026-106166

Deferred Deferred - Pending Action

Unauthenticated Form Entry Modification in NEX-Forms WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106166

EUVD

EUVD-2026-100883

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	NEX-Forms	9.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in the NEX-Forms WordPress plugin before version 9.3.1 allows unauthenticated attackers to modify form entries without authorization. They can overwrite, erase, reassign, or append data to any existing form entry by referencing its sequential identifier due to missing checks.

Detection Guidance

To detect this vulnerability, check if you are running NEX-Forms plugin versions 9.2.1 to 9.2.5. Verify if unauthenticated users can modify form entries by attempting to access or alter entries via sequential IDs without authentication. Monitor for unexpected changes to form data or unauthorized modifications.

Impact Analysis

An attacker could alter or delete sensitive form data, such as user submissions or records, leading to data loss or corruption. This compromises data integrity and confidentiality, potentially exposing personal or confidential information.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by allowing unauthorized modifications to personal or health data, leading to data breaches and potential legal penalties.

Mitigation Strategies

Immediately update the NEX-Forms WordPress plugin to version 9.3.1 or later to patch the vulnerability. Disable or remove the plugin if updating is not possible.

Hi! I’m here to help you understand CVE-2026-106166. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70