The NEX-Forms WordPress plugin prior to version 9.3.1 lacks authorization, ownership, and request‑validation checks when updating stored form entries. An unauthenticated attacker can reference a sequential identifier through the 'nf_set_entry_update_id' parameter and overwrite, permanently erase, reassign, or append to any existing entry. This vulnerability enables extensive compromise of the integrity of user‑submitted data within the affected site.

WordPress sites running the NEX-Forms plugin versions 9.2.1 to 9.2.5 are impacted. The vendor is listed as Unknown:NEX-Forms; no additional product or version details are provided beyond the stated range.

The EPSS score is below 1%, indicating a low exploitation probability, but the flaw can be triggered without authentication and does not require privileged access. An attacker could send a crafted HTTP request to the update endpoint, supplying a valid sequential ID and new payload via 'nf_set_entry_update_id'. Because the plugin does not verify ownership or request integrity, the request succeeds, allowing arbitrary modification of any stored entry. The CVSS base score is 5.3, reflecting moderate severity for the potential impact on data integrity. The vulnerability is not listed in CISA KEV.