CVE-2026-9017— NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9017
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action
Source: NVD (National Vulnerability Database)
Vulnerability Description
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users, and cause the site to dispatch attacker-controlled email content to attacker-chosen recipient addresses.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| webaways | NEX-Forms – Ultimate Forms Plugin for WordPress | 0 ~ 9.2.2 | - |
II. Public POCs for CVE-2026-9017
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9017
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-13040
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-12142
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-12404
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticate - CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - - CVE-2026-5063
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scri
Same vendor: webaways
- CVE-2026-13040
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-12142
NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scrip - CVE-2026-12404
NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticate - CVE-2026-7046
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - - CVE-2026-5063
NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scri
Same weakness: CWE-862
- CVE-2026-61442
PraisonAI Platform before 0.1.9 Authorization Bypass via PAT - CVE-2026-12103
Wallet for WooCommerce <= 1.6.4 - Missing Authorization to A - CVE-2026-12994
WCFM – Frontend Manager for WooCommerce <= 6.7.27 - Missing - CVE-2026-12738
WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticate - CVE-2026-1832
ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated
V. Comments for CVE-2026-9017
No comments yet