The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to an Insecure Direct Object Reference that allows unauthenticated attackers to overwrite arbitrary form entries by supplying the 'nf_set_entry_update_id' parameter in the form submission request. This flaw exposes a straight‑forward data integrity issue, enabling malicious actors to replace legitimate submission data with crafted content, potentially exposing sensitive information, altering transaction records, or tampering with user‑generated content. The weakness is classified as CWE‑639 (Authorization Bypass Through User Controlled Key).

All installations of the webaways NEX-Forms – Ultimate Forms Plugin for WordPress up to and including version 9.1.9 are affected.

With a CVSS score of 7.5, the vulnerability carries a high risk rating. The EPSS score is less than 1% and the issue is not listed in the CISA KEV catalog, indicating a lower current exploit probability. The likely attack vector is an unauthenticated HTTP request to the plugin’s form submission endpoint, where the attacker can submit crafted form data containing the offending 'nf_set_entry_update_id' parameter to modify existing entries. Exploitation requires no special privileges and is achievable by anyone with internet access to the affected site.