CVE-2026-12404: CWE-862 Missing Authorization in webaways NEX-Forms – Ultimate Forms Plugin for WordPress
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate sequential report IDs and download complete form submission data — including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths — for any saved report on the site.
AI Analysis
Technical Summary
CVE-2026-12404 is an authorization bypass vulnerability (CWE-862) in the NEX-Forms – Ultimate Forms Plugin for WordPress. Versions up to and including 9.2.2 do not properly verify user authorization before allowing access to form submission reports. As a result, unauthenticated attackers can sequentially enumerate report IDs and download sensitive data contained in these reports. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date.
Potential Impact
An attacker without any authentication can access and download sensitive user-submitted data stored in form reports, including personal identifiable information and payment details. This exposure can lead to privacy violations and potential data leakage, but does not affect system integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's report URLs via web server access controls or other means to prevent unauthorized access. Monitor for updates from the vendor regarding patches or official mitigations.
CVE-2026-12404: CWE-862 Missing Authorization in webaways NEX-Forms – Ultimate Forms Plugin for WordPress
Description
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate sequential report IDs and download complete form submission data — including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths — for any saved report on the site.
CVSS v3.1
Score 5.3medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12404 is an authorization bypass vulnerability (CWE-862) in the NEX-Forms – Ultimate Forms Plugin for WordPress. Versions up to and including 9.2.2 do not properly verify user authorization before allowing access to form submission reports. As a result, unauthenticated attackers can sequentially enumerate report IDs and download sensitive data contained in these reports. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date.
Potential Impact
An attacker without any authentication can access and download sensitive user-submitted data stored in form reports, including personal identifiable information and payment details. This exposure can lead to privacy violations and potential data leakage, but does not affect system integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's report URLs via web server access controls or other means to prevent unauthorized access. Monitor for updates from the vendor regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-16T13:40:57.176Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3f687727e9c79719d3a913
Added to database: 06/27/2026, 06:06:47 UTC
Last enriched: 07/04/2026, 22:10:04 UTC
Last updated: 08/11/2026, 00:41:10 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.