CVE-2026-12404: NEX-Forms Auth Bypass Vulnerability

CVE-2026-12404 Overview

CVE-2026-12404 is an authorization bypass vulnerability in the NEX-Forms – Ultimate Forms Plugin for WordPress. The flaw affects all versions up to and including 9.2.2. The plugin fails to properly verify user authorization before returning saved form report data. Unauthenticated attackers can enumerate sequential report IDs and download complete form submissions from any saved report on the site. Exposed data includes names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths. The issue is tracked under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated remote attackers can harvest submitted form data — including personally identifiable information (PII) and payment details — by iterating over sequential report IDs.

Affected Products

NEX-Forms – Ultimate Forms Plugin for WordPress, all versions ≤ 9.2.2
WordPress sites with the nex-forms-express-wp-form-builder plugin installed
Sites relying on NEX-Forms for collecting PII, payment, or file-upload submissions

Discovery Timeline

2026-06-27 - CVE-2026-12404 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-12404

Vulnerability Analysis

The vulnerability resides in the report-retrieval logic of main.php within the nex-forms-express-wp-form-builder plugin. Public references point to specific lines (L3648, L3654, L3792) in tags 9.1.12 and 9.2.2. These code paths handle report access requests but do not perform a capability check against the requesting user. As a result, any HTTP client — authenticated or not — can request stored form submission data by supplying a numeric report identifier.

Because report IDs are assigned sequentially, an attacker can iterate from 1 upward and enumerate every saved report on the target site. The returned payload includes full submission content: contact fields, address blocks, payment metadata, and file paths for any documents uploaded through the form.

Root Cause

The root cause is Missing Authorization ([CWE-862]). The affected handlers process report queries without validating the WordPress user session, nonce, or role capability. Access control is effectively delegated to knowledge of the report ID, which is neither secret nor unpredictable.

Attack Vector

The vulnerability is exploitable over the network with no authentication and no user interaction. An attacker sends crafted HTTP requests to the plugin endpoint responsible for report retrieval, incrementing the report ID parameter to walk the entire dataset. No privileges, tokens, or victim interaction are required. See the Wordfence Vulnerability Analysis for additional technical context.

No verified proof-of-concept code is published at the time of writing. The vulnerable code paths are documented in the WordPress Plugin Code Snippet at L3648 and adjacent lines.

Detection Methods for CVE-2026-12404

Indicators of Compromise

Sequential HTTP requests to NEX-Forms report endpoints containing incrementing numeric identifiers.
Bursts of admin-ajax.php or plugin AJAX requests from a single client IP with no prior authenticated session cookies.
Outbound responses containing large volumes of form submission JSON to unauthenticated clients.
Access log entries referencing nex-forms action parameters from user-agents not matching normal site administrators.

Detection Strategies

Review web server access logs for high-volume requests targeting NEX-Forms AJAX actions with varying id parameters.
Deploy a Web Application Firewall (WAF) rule that flags unauthenticated requests to NEX-Forms report endpoints.
Correlate spikes in plugin endpoint response size with the absence of a valid wordpress_logged_in_* cookie.
Alert on the same source IP requesting more than N distinct report IDs within a short window.

Monitoring Recommendations

Enable verbose access logging on wp-admin/admin-ajax.php and preserve query parameters.
Forward WordPress and web server logs to a centralized SIEM for retention and correlation.
Track the NEX-Forms plugin version across all managed WordPress instances in your asset inventory.
Monitor for unusual egress volume from web servers hosting the plugin.

How to Mitigate CVE-2026-12404

Immediate Actions Required

Upgrade the NEX-Forms plugin to a fixed release beyond version 9.2.2 as soon as the vendor publishes one.
Audit stored NEX-Forms reports for sensitive data and rotate any exposed credentials or payment tokens.
Restrict access to admin-ajax.php NEX-Forms actions at the WAF layer until the plugin is patched.
Notify affected data subjects if log analysis indicates report enumeration occurred.

Patch Information

The vendor code changeset is tracked in the WordPress Plugin Repository changeset 3584399. Site administrators should install the fixed release from the official WordPress plugin repository and confirm the plugin version reports higher than 9.2.2 after the upgrade.

Workarounds

Temporarily deactivate the NEX-Forms plugin until a patched version is installed.
Add a WAF rule that requires an authenticated session cookie for any request invoking NEX-Forms report actions.
Block direct external access to the plugin's AJAX endpoints and allow only authenticated administrator IPs.
Purge non-essential historical reports containing PII from the database to reduce exposure.

bash

# Example WAF/nginx rule: deny unauthenticated access to NEX-Forms report actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^nex_forms_(get_report|download_report|view_submission)") {
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}