The NEX-Forms – Ultimate Form Builder plugin for WordPress suffers from a sensitive information exposure vulnerability (CWE-200) in all versions up to 8.8.1. The issue arises because the plugin does not prevent directory listing and does not randomize uploaded file names, enabling unauthenticated attackers to retrieve sensitive files uploaded through forms. This vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with an attack vector of network, no privileges required, and no user interaction needed. No patch or remediation guidance is currently provided by the vendor or in public advisories.

An unauthenticated attacker can access sensitive files uploaded via the plugin's forms, potentially exposing confidential data. The vulnerability does not affect system integrity or availability but compromises confidentiality. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to upload directories via web server configuration to prevent directory listing and unauthorized file access. Monitor for updates from the vendor regarding patches or official mitigations.