CVE-2025-15510: CWE-862 Missing Authorization in webaways NEX-Forms – Ultimate Forms Plugin for WordPress
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter.
AI Analysis
Technical Summary
The NEX-Forms – Ultimate Forms Plugin for WordPress suffers from a missing capability check in the NF5_Export_Forms class constructor. This authorization bypass vulnerability enables unauthenticated attackers to export form configuration data by enumerating the nex_forms_Id parameter. The exposed data can include sensitive information like email addresses and API credentials. The issue is tracked as CVE-2025-15510 with a CVSS 3.1 base score of 5.3, indicating a medium severity impact. No known exploits are reported in the wild, and no patch or official fix details are currently available.
Potential Impact
An attacker without authentication can access and export form configuration data that may contain sensitive information such as email addresses, PayPal API credentials, and third-party integration keys. This could lead to information disclosure but does not directly impact data integrity or availability according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's export functionality and monitor for unauthorized access attempts. Avoid exposing the nex_forms_Id parameter to untrusted users.
CVE-2025-15510: CWE-862 Missing Authorization in webaways NEX-Forms – Ultimate Forms Plugin for WordPress
Description
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The NEX-Forms – Ultimate Forms Plugin for WordPress suffers from a missing capability check in the NF5_Export_Forms class constructor. This authorization bypass vulnerability enables unauthenticated attackers to export form configuration data by enumerating the nex_forms_Id parameter. The exposed data can include sensitive information like email addresses and API credentials. The issue is tracked as CVE-2025-15510 with a CVSS 3.1 base score of 5.3, indicating a medium severity impact. No known exploits are reported in the wild, and no patch or official fix details are currently available.
Potential Impact
An attacker without authentication can access and export form configuration data that may contain sensitive information such as email addresses, PayPal API credentials, and third-party integration keys. This could lead to information disclosure but does not directly impact data integrity or availability according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's export functionality and monitor for unauthorized access attempts. Avoid exposing the nex_forms_Id parameter to untrusted users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-01-12T09:18:03.372Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 697d6520ac06320222aa2326
Added to database: 1/31/2026, 2:12:48 AM
Last enriched: 4/9/2026, 9:57:43 AM
Last updated: 5/1/2026, 1:29:53 PM
Views: 136
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.