A critical IDOR vulnerability in the NEX-Forms WordPress plugin allows unauthenticated attackers to modify sensitive form data, posing a significant risk to data integrity.

The vulnerability exists within the submit_nex_form function, where a lack of validation on the nf_set_entry_update_id parameter allows unauthenticated users to perform unauthorized write operations on form entries.

The ability for an unauthenticated attacker to overwrite form entries can lead to severe data corruption, unauthorized modification of user-submitted information, and the potential for fraudulent data injection. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to the reliability of business processes that depend on form-based data collection.

Immediate Action: Update the NEX-Forms – Ultimate Forms Plugin for WordPress to the latest version immediately to ensure the missing validation is applied.

Proactive Monitoring: Review database logs for suspicious or unauthorized modifications to form entry tables and monitor plugin activity for unexpected execution of the submit_nex_form function.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests containing anomalous values in the nf_set_entry_update_id parameter until the patch is deployed.

Public Exploit Available: Unknown

Organizations utilizing the NEX-Forms plugin must prioritize this update as part of their standard security maintenance cycle. Because the vulnerability allows for unauthenticated data manipulation, failure to patch leaves the application exposed to simple, automated exploitation attempts that could compromise the integrity of business records.