The NEX-Forms – Ultimate Forms Plugin for WordPress contains an authorization bypass in the nf_send_nf_email AJAX action. Because the plugin does not verify that the caller is authorized, an unauthenticated user can overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of any form entry owned by another user. This change results in the site dispatching emails whose recipients and content are chosen by the attacker. Based on the description, it is inferred that an attacker could use this capability to send malicious or phishing emails, but that specific use case is not explicitly stated in the CVE data.

WordPress sites that have installed the Webaways NEX-Forms plugin version 9.2.2 or any earlier release are affected. The vulnerability applies to all versions up to and including 9.2.2 regardless of site configuration or traffic type.

The vulnerability has a CVSS score of 5.3, which indicates moderate severity. Its EPSS score is reported as < 1%, suggesting a low probability of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit the issue by sending unauthenticated HTTP requests to the nf_send_nf_email endpoint, which lacks proper authentication or role checks, thereby allowing arbitrary modification of email settings and the dispatch of attacker‑controlled messages.