The NEX-Forms – Ultimate Forms Plugin for WordPress contains a missing capability check in the NF5_Export_Forms class constructor. This flaw allows any unauthenticated user to trigger the export functionality and retrieve form configurations, which may carry email addresses, payment gateway credentials, and third‑party integration keys. The weakness is a classic missing authorization failure, classified as CWE-862.

The vulnerability affects the Webaways NEX-Forms – Ultimate Forms Plugin for WordPress, versions up to and including 9.1.8. Attackers can exploit the flaw by supplying a valid nex_forms_Id value in an HTTP request to the export endpoint, bypassing all permission checks.

With a CVSS score of 5.3 the issue is of moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Detection hinges on the presence of the public export URL and the ability to enumerate form identifiers. Once accessed, an attacker can exfiltrate potentially sensitive configuration data without authentication.