CVE-2026-9017 is an authorization bypass vulnerability (CWE-862) in the NEX-Forms – Ultimate Forms Plugin for WordPress, affecting all versions up to and including 9.2.2. The plugin fails to properly verify that a user is authorized to perform certain actions, enabling unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users. This can lead to the site dispatching attacker-controlled email content to attacker-chosen recipient addresses. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No official patch or remediation guidance is currently documented.

The vulnerability allows unauthenticated attackers to modify email-related fields in form entries of other users, which can be exploited to send emails with attacker-controlled content to arbitrary recipients. This could be used for phishing, spam, or other malicious email campaigns leveraging the trusted site. There is no direct impact on confidentiality or availability, but integrity of form data and email dispatch is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and monitor for suspicious activity related to form email fields. Avoid exposing the plugin to untrusted users or anonymous access. Follow vendor updates closely for a security patch.