PT-2024-16894 · WordPress · Nex-Forms

Francesco Carlucci

·

Published

2024-02-01

·

Updated

2025-01-15

·

CVE-2024-1130

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress versions up to, and including, 8.5.6
Description The issue is related to unauthorized access due to a missing capability check on the set read() function. This allows authenticated attackers with subscriber-level access and above to mark records as read.
Recommendations For versions up to, and including, 8.5.6, update to a version that includes a fix for the missing capability check on the set read() function. As a temporary workaround, consider restricting access to the set read() function to prevent unauthorized marking of records as read.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-1130

Affected Products

Nex-Forms