CVE-2026-9017
Received Received - Intake

Authorization Bypass in NEX-Forms WordPress Plugin

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: Wordfence

Description
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users, and cause the site to dispatch attacker-controlled email content to attacker-chosen recipient addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-9017
EUVD
EUVD-2026-43163

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpforms nex-forms to 9.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 9.2.2. This means the plugin does not properly verify whether a user is authorized to perform certain actions.

As a result, unauthenticated attackers can overwrite specific fields (saved_admin_email, saved_user_email, and saved_user_email_address) in form entries that belong to other users.

This allows attackers to cause the site to send email content controlled by them to recipient addresses of their choosing.

Impact Analysis

This vulnerability can allow attackers to send emails from your site with content and recipients they control.

Such unauthorized email dispatch could be used for phishing, spam, or other malicious activities that damage your site's reputation and trustworthiness.

Since the attacker can overwrite email fields of other users' form entries, it may also lead to confusion or misuse of user data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9017. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart