CVE-2026-106166 — NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter

CVE-2026-106166

NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter PUBLISHED

Description (CNA)

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.

Affected (CNA)

Vendor / product	Versions
Unknown / NEX-Forms	affected 9.2.1 before 9.3.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/aa33ce05-091d-4fef-b875-4fedb8b8fc9d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.