The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable because the deactivate_license() function lacks a capability check. This flaw allows any authenticated user with Subscriber-level access or higher to deactivate the plugin license. As a result, the plugin becomes inoperative, causing loss of form functionality and potential disruption of business processes that depend on it. The weakness is classified as CWE-862 (Missing Authorization).

The vulnerability affects the webaways NEX-Forms – Ultimate Forms Plugin for WordPress, in all versions up to and including 9.1.9. No specific sub‑versions are listed beyond this upper bound.

The CVSS score is 4.3, indicating low-to-moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The flaw is not present in CISA’s Known Exploited Vulnerabilities catalog. Because the issue requires an authenticated account with at least Subscriber permissions, any site that has such users is at risk of accidental or malicious license deactivation, but the damage is confined to service disruption rather than data loss or compromise.