CVE-2026-106166: Unknown Nex-Forms

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.

Affected products

• Unknown Nex-Forms: from 9.2.1, before 9.3.1 (fixed in 9.3.1)

Published 2026-10-14. Last modified 2026-10-14.