The plugin contains an authorization bypass that occurs when the CSVExport class does not verify a user’s privilege before exporting report data. An unauthenticated attacker can therefore enumerate sequential report IDs and download complete form submission information, including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths. This results in a confidentiality breach that matches CWE‑862, missing authorization.

The NEX‑Forms Ultimate Forms Plugin for WordPress, versions up to and including 9.2.2, is vulnerable. The vendor, Webaways, has not released a fixed version in the range mentioned, so all installations of these versions on any WordPress site are at risk.

The CVSS score of 5.3 indicates medium severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. The attack vector is inferred to be remote via standard HTTP requests to the plugin’s export endpoint, which does not enforce authentication. Exploitation is straightforward: an attacker submits requests with sequential report identifiers until valid submissions are retrieved, exposing sensitive personal data.