CVE-2020-36670: The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 due to missing…

PriorityP336medium6.3CVSS 3.1

AVNACLPRLUINSUCLILAL

EPSS

0.55%

42.0th percentile

The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber level permissions and above to invoke these functions which can be used to perform actions like modify form submission records, deleting files, sending test emails, modifying plugin settings, and more.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
basixonline	nex-forms	<= 7.7.1	—
webaways	nex-forms_ultimate_forms_plugin_for_wordpress	<= 7.7.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.