Executive Summary

The vulnerability exists in the NEX-Forms – Ultimate Forms Plugin for WordPress, affecting all versions up to and including 9.2.2. It is an authorization bypass issue caused by the plugin failing to properly verify whether a user is authorized to perform certain actions.

Because of this flaw, unauthenticated attackers can enumerate sequential report IDs and download complete form submission data from the site.

The exposed data can include sensitive information such as names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive personal and payment information collected through forms on a WordPress site using the affected plugin.

Attackers can access private form submission data without authentication, potentially leading to privacy breaches, identity theft, financial fraud, and reputational damage for the site owner.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to access and download sensitive form submission data including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths.

Such unauthorized access to personal and payment information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive data.

Therefore, exploitation of this vulnerability could result in violations of these standards due to improper authorization and potential data breaches.

Useful 0 Not Useful 0