Medium severity · published Oct 14, 2026
CVE-2026-106166
NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
NEX-Forms ·
9.2.1 before 9.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106166
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106166
exploit
https://wpscan.com/vulnerability/aa33ce05-091d-4fef-b875-4fedb8b8fc9d/
More from NEX-Forms
7.2
CVE-2023-2114
NEX-Forms < 8.4 - Admin+ SQL Injection
6.8
CVE-2025-14803
Nex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSS
6.1
CVE-2026-10525
NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission
5.4
CVE-2023-0439
NEX-Forms < 8.4.4 - Authenticated Stored XSS
5.4
CVE-2023-0272
NEX-Forms < 8.3.3 - Contributor+ Stored XSS