CVE-2026-9017 is an authorization bypass vulnerability (CWE-862) in the NEX-Forms – Ultimate Forms Plugin for WordPress. The plugin fails to verify that a user is authorized to perform certain actions, enabling unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields in arbitrary form entries belonging to other users. This can result in the site dispatching emails with attacker-controlled content to attacker-chosen recipients. The vulnerability affects all versions up to and including 9.2.2. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation has been indicated in the available data.

An unauthenticated attacker can exploit this vulnerability to overwrite email fields in form entries of other users, causing the affected WordPress site to send emails with attacker-controlled content to recipients chosen by the attacker. This could be used for phishing or spam campaigns leveraging the trusted site. There is no direct confidentiality or availability impact reported, but integrity of email data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionalities where possible and monitor for suspicious email activity. Avoid exposing the plugin's administrative or form management interfaces to unauthenticated users. Follow vendor updates closely for an official patch or mitigation.