CVE-2024-13498: NEX-Forms WordPress Plugin Data Leak Flaw

CVE-2024-13498 Overview

CVE-2024-13498 affects the NEX-Forms – Ultimate Form Builder plugin for WordPress in all versions up to and including 8.8.1. The vulnerability exposes files uploaded through forms to unauthenticated attackers. Two weaknesses cause the issue: the plugin does not prevent directory listing on the upload path, and it does not randomize uploaded file names. Attackers can enumerate the upload directory and retrieve submitted files directly. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can enumerate and download user-submitted files, including personally identifiable information (PII), identity documents, and other sensitive data uploaded through NEX-Forms.

Affected Products

NEX-Forms – Ultimate Form Builder – Contact forms and much more (WordPress plugin)
All versions up to and including 8.8.1
WordPress sites accepting file uploads through NEX-Forms

Discovery Timeline

2025-03-12 - CVE-2024-13498 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13498

Vulnerability Analysis

NEX-Forms allows site administrators to build contact and data-collection forms that include file upload fields. Submissions are written to a predictable directory served by the web server. The plugin does not deploy an index.php or .htaccess file to suppress directory listing, and it does not rename uploaded files with a random or hashed identifier. An unauthenticated attacker who requests the upload directory URL can therefore see the full list of files and download each entry directly. File names often reveal the original document contents, and the files themselves may contain resumes, contracts, identification scans, or other regulated data.

The vulnerability requires no authentication, no user interaction, and can be triggered over the network. Exploitation is limited to reading files; there is no direct impact on integrity or availability.

Root Cause

Two control failures combine to produce the exposure. First, the upload directory lacks a directory-listing suppression mechanism, so the web server responds with a full index when the path is requested. Second, uploaded files retain the original client-supplied name without randomization or obfuscation. Even where directory listing is disabled at the server level, predictable file names allow enumeration through guessing common naming patterns.

Attack Vector

An attacker locates a WordPress site running the NEX-Forms plugin, identifies the plugin's upload path under wp-content/uploads/, and issues an HTTP GET request to that directory. If directory listing is enabled, the server returns an HTML index of every uploaded file. The attacker then requests each file directly and retrieves its contents. Public search engines and archive services may also index the upload directory, exposing files without any active probing. Details of the fix are recorded in the WordPress plugin changeset 3235420 and the Wordfence vulnerability report.

No verified proof-of-concept code is published for CVE-2024-13498.
Exploitation reduces to an HTTP GET against the plugin's upload directory
followed by direct retrieval of listed file names.

Detection Methods for CVE-2024-13498

Indicators of Compromise

Unauthenticated HTTP GET requests to wp-content/uploads/ paths associated with NEX-Forms that return an HTML directory index (Index of /).
Sequential or scripted downloads of multiple files from the NEX-Forms upload directory from a single source IP.
Requests to upload paths from user agents associated with crawlers, scrapers, or automated scanners.
Search engine cache entries or public archives containing file names from the plugin's upload directory.

Detection Strategies

Review web server access logs for GET requests to NEX-Forms upload directories that return 200 OK without a trailing file name.
Alert on repeated file downloads from wp-content/uploads/ subdirectories by unauthenticated clients over short time windows.
Query search engines for site:example.com "Index of" and NEX-Forms path fragments to confirm public exposure.
Compare the WordPress plugin inventory against version 8.8.1 and earlier to identify vulnerable installations.

Monitoring Recommendations

Ingest WordPress and reverse-proxy access logs into a centralized log platform and retain them for retrospective analysis.
Enable file integrity monitoring on the plugin directory to detect changes to upload paths and configuration files.
Track outbound data volume from web servers to identify bulk exfiltration of uploaded submissions.

How to Mitigate CVE-2024-13498

Immediate Actions Required

Update the NEX-Forms – Ultimate Form Builder plugin to a version later than 8.8.1 that includes the fix from changeset 3235420.
Audit the plugin's upload directory for exposed files and rotate or invalidate any credentials or documents that may have been retrieved.
Notify affected form submitters if regulated data such as PII or identity documents was exposed.

Patch Information

The vendor addressed the issue in the plugin update referenced by WordPress plugin changeset 3235420. The fix adds directory listing prevention and randomizes uploaded file names so that unauthenticated actors cannot enumerate or guess submission paths. Consult the Wordfence advisory for the specific fixed version and validation guidance.

Workarounds

Disable directory indexing at the web server level by adding Options -Indexes to Apache configuration or the appropriate directive in Nginx.
Place an empty index.php or index.html file inside the NEX-Forms upload directory and each subdirectory to suppress listings.
Restrict direct HTTP access to the upload path through a web application firewall rule until the plugin is updated.
Move sensitive submission storage outside the web root if the plugin configuration allows an alternate destination.

bash

# Apache: disable directory listing for the NEX-Forms upload path
# Add to .htaccess inside wp-content/uploads/nex-forms-uploaded-files/
Options -Indexes
<FilesMatch "\.(pdf|docx?|xlsx?|jpg|png|zip)$">
    Require all denied
</FilesMatch>

# Nginx: block directory listing and direct file access
location ~* /wp-content/uploads/nex-forms-uploaded-files/ {
    autoindex off;
    deny all;
    return 403;
}