NEX-Forms <= 9.2.2 Missing Authorization to Unauthenticated Sensitive Information Disclosure (CVE-2026-12404)

Vulnerability Overview Vulnerability Name: NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class CVE ID: CVE-2026-12404 CVSS Score: 5.3 (Medium) Publication Date: June 26, 2026 Last Update Date: June 27, 2026 Researcher: valent1 Impact Scope Affected Versions: NEX-Forms <= 9.2.2 Vulnerability Type: Unauthenticated Access Leading to Sensitive Information Disclosure Description: The NEX-Forms plugin contains an authorization bypass vulnerability that allows unauthenticated attackers to enumerate serialized report IDs and download complete report submission data containing sensitive information such as names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths. Remediation Fixed Version: 9.2.3 Recommendation: Upgrade to version 9.2.3 or later to remediate this vulnerability. Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Recent Vulnerabilities CVE-2026-12142: NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via Array Parameter CVE-2026-7046: NEX-Forms - Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via Parameter CVE-2026-5063: NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names CVE-2026-1947: NEX-Forms - Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary User Modification via CVE-2026-1948: NEX-Forms - Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via CVE-2025-69326: NEX-Forms <= 9.1.7 - Reflected Cross-Site Scripting CVE-2025-69324: NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting CVE-2025-15510: NEX-Forms - Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVE-2025-14803: NEX-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2025-10185: NEX-Forms - Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection Summary The NEX-Forms plugin in versions 9.2.2 and earlier contains an unauthenticated access vulnerability leading to sensitive information disclosure. Users are advised to upgrade to version 9.2.3 or later to resolve this issue.

Goal Reached Thanks to every supporter — we hit 100%!

NEX-Forms <= 9.2.2 Missing Authorization to Unauthenticated Sensitive Information Disclosure (CVE-2026-12404)

More from this source