The NEX-Forms – Ultimate Form Builder plugin for WordPress suffers from a missing capability check in the set_starred() function, which leads to unauthorized access. Authenticated users with subscriber-level privileges or above can exploit this flaw to mark records as starred, bypassing intended access controls. This issue is tracked as CVE-2024-1129 and is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and limited impact on integrity only.

The vulnerability allows authenticated users with minimal privileges (subscriber-level) to modify the starred status of records within the plugin. This unauthorized modification could affect data integrity by altering record metadata but does not expose or compromise confidential information or availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting subscriber-level access or monitoring for unusual activity related to record starring. No official patch or workaround is currently documented.