# CVE-2026-12404: Webaways NEX-Forms WordPress plugin authorization bypass

Source: https://junglewise.ai/threats/cve-2026-12404-webaways-nex-forms-wordpress-plugin-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-27. Updated: 2026-06-27  
License: CC BY 4.0 with a link back

CVE-2026-12404 · Severity: medium · CVSS 5.3 · Published 2026-06-27

The NEX-Forms plugin for WordPress, which is used to create and manage website forms, contains a security flaw that allows unauthorized access to submitted data. An attacker can exploit this to download sensitive information provided by users, such as names, email addresses, phone numbers, and payment details. This could lead to significant privacy breaches and the exposure of customer personal information.

Technologies: [Webaways NEX-Forms – Ultimate Forms Plugin for WordPress](https://junglewise.ai/threats/technologies/nex-forms-ultimate-forms-plugin-for-wordpress). Vendors: [Webaways](https://junglewise.ai/threats/vendors/webaways).

## Quick answers

**Is CVE-2026-12404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12404 being exploited in the wild.

**How severe is CVE-2026-12404?** Medium severity, with a CVSS score of 5.3, published 27 June 2026.

**Which products and versions are affected?** Webaways NEX-Forms – Ultimate Forms Plugin for WordPress up to and including 9.2.2.

**Is there a fix for CVE-2026-12404?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12404 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12404?** Check whether you run Webaways NEX-Forms – Ultimate Forms Plugin for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The NEX-Forms plugin for WordPress (versions up to 9.2.2) fails to implement proper authorization checks on its reporting functionality. This missing authorization (CWE-862) allows unauthenticated remote attackers to perform ID enumeration on sequential report IDs. By iterating through these IDs, an attacker can download full form submission records, which include PII such as names, emails, addresses, and payment details, as well as paths to uploaded files. The vulnerability is exploitable via direct network requests without any prior authentication or user interaction.

## Affected products

- webaways NEX-Forms – Ultimate Forms Plugin for WordPress up to and including 9.2.2

## Timeline

- 2026-06-27: disclosed
- 2026-06-27: advisory

## References

- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.12/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php)
- [https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php](https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.2.2/main.php)
- [https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3584399%40nex-forms-express-wp-form-builder&new=3584399%40nex-forms-express-wp-form-builder&sfp_email=&sfph_mail=](https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3584399%40nex-forms-express-wp-form-builder&new=3584399%40nex-forms-express-wp-form-builder&sfp_email=&sfph_mail=)

## Related threats

- [Webaways NEX-Forms authorization bypass in form entries](https://junglewise.ai/threats/cve-2026-9017-webaways-nex-forms-authorization-bypass-in-form-entries)
- [Webaways NEX-Forms Stored XSS in real_val__ parameter](https://junglewise.ai/threats/cve-2026-13040-webaways-nex-forms-stored-xss-in-real-val-parameter)
- [webaways NEX-Forms Stored XSS via _name[] parameter](https://junglewise.ai/threats/cve-2026-12142-webaways-nex-forms-stored-xss-via-name-parameter)