CVE-2026-1947 describes an insecure direct object reference vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress. The issue is due to missing validation on a user-controlled key parameter ('nf_set_entry_update_id') in the submit_nex_form() function, which allows unauthenticated attackers to overwrite arbitrary form entries. This vulnerability affects all versions up to and including 9.1.9. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, but high integrity impact.

An unauthenticated attacker can overwrite arbitrary form entries in the affected plugin, potentially leading to data integrity issues. There is no reported impact on confidentiality or availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the vulnerable functionality or disabling the plugin if feasible to prevent exploitation.