CVE-2026-9017— NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| webaways | NEX-Forms – Ultimate Forms Plugin for WordPress | ≤ 9.2.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9017
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users, and cause the site to dispatch attacker-controlled email content to attacker-chosen recipient addresses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
webaways NEX-Forms – Ultimate Forms Plugin for WordPress 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
webaways NEX-Forms – Ultimate Forms Plugin for WordPress是webaways的WordPress表单插件。 webaways NEX-Forms – Ultimate Forms Plugin for WordPress 9.2.2及之前版本存在授权问题漏洞，该漏洞源于插件未正确验证用户授权行为，可能导致未经验证的攻击者覆盖其他用户表单条目中的saved_admin_email、saved_user_email和saved_user_email_add
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| webaways | NEX-Forms – Ultimate Forms Plugin for WordPress | 0 ~ 9.2.2 | - |
II. Public POCs for CVE-2026-9017
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9017
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-15450
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File - CVE-2026-13040
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-12142
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-12404
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticate - CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 -
Same vendor: webaways
- CVE-2026-15450
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File - CVE-2026-13040
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-12142
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-12404
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticate - CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 -
Same weakness: CWE-862
- CVE-2026-8840
Booking calendar, Appointment Booking System <= 3.2.36 - Mis - CVE-2026-73048
SiYuan before v3.7.4 Information Disclosure via getRefIDsByF - CVE-2026-72825
Grav before 1.0.13 API-key scope cap bypass via ReportsContr - CVE-2026-72824
Grav before 1.0.13 API Key Scope Bypass via PagesController - CVE-2026-72823
Grav before 1.0.13 API-key scope cap bypass via DemoControll
V. Comments for CVE-2026-9017
No comments yet