CVE-2025-15510

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15510", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-12T09:18:03.372Z", "datePublished": "2026-01-31T01:23:02.888Z", "dateUpdated": "2026-04-08T17:28:13.139Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:13.139Z"}, "affected": [{"vendor": "webaways", "product": "NEX-Forms \u2013 Ultimate Forms Plugin for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "9.1.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The NEX-Forms \u2013 Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter."}], "title": "NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddfa5a3d-fef2-4049-915c-51c3e28153bf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.7/includes/classes/class.export.php#L11"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "timeline": [{"time": "2025-12-16T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-12T09:33:22.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-30T12:12:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T17:58:58.601111Z", "id": "CVE-2025-15510", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T17:59:10.523Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-02T17:58:58.601111Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T17:59:06.311Z"}}], "cna": {"title": "NEX-Forms \u2013 Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Deadbee"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "webaways", "product": "NEX-Forms \u2013 Ultimate Forms Plugin for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.1.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-16T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-12T09:33:22.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-30T12:12:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddfa5a3d-fef2-4049-915c-51c3e28153bf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.7/includes/classes/class.export.php#L11"}], "descriptions": [{"lang": "en", "value": "The NEX-Forms \u2013 Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:13.139Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15510", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:13.139Z", "dateReserved": "2026-01-12T09:18:03.372Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-31T01:23:02.888Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "NEX-Forms \u2013 Ultimate Forms Plugin for WordPress", "vendor": "webaways", "versions": [{"lessThanOrEqual": "9.1.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The NEX-Forms \u2013 Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter."}, {"lang": "es", "value": "El plugin NEX-Forms \u2013 Ultimate Forms para WordPress es vulnerable a acceso no autorizado a datos debido a una comprobaci\u00f3n de capacidad faltante en el constructor de la clase NF5_Export_Forms en todas las versiones hasta la 9.1.8, inclusive. Esto hace posible que atacantes no autenticados exporten configuraciones de formularios, que pueden incluir datos sensibles, como direcciones de correo electr\u00f3nico, credenciales de la API de PayPal y claves de integraci\u00f3n de terceros al enumerar el par\u00e1metro nex_forms_Id."}], "id": "CVE-2025-15510", "lastModified": "2026-06-17T08:37:55.523", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15510", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T17:58:58.601111Z", "version": "2.0.3"}}]}, "published": "2026-01-31T02:16:04.273", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/tags/9.1.7/includes/classes/class.export.php#L11"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddfa5a3d-fef2-4049-915c-51c3e28153bf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T20:58:33.900451+00:00", "value": {"mitigation_remediation": ["Upgrade NEX-Forms to the latest version that restores proper capability checks. ", "If an upgrade is not immediately possible, add a role or capability check to the export functionality or remove the export endpoint for users lacking administrative permissions. ", "Restrict or block unauthenticated HTTP requests to the export URL through web server rules or application firewall settings."], "summary": {"action": "Update Plugin", "impact": "Unauthorized disclosure of sensitive information in form configurations"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Webaways NEX-Forms \u2013 Ultimate Forms Plugin for WordPress, versions up to and including 9.1.8. Attackers can exploit the flaw by supplying a valid nex_forms_Id value in an HTTP request to the export endpoint, bypassing all permission checks.", "description_and_impact": "The NEX-Forms \u2013 Ultimate Forms Plugin for WordPress contains a missing capability check in the NF5_Export_Forms class constructor. This flaw allows any unauthenticated user to trigger the export functionality and retrieve form configurations, which may carry email addresses, payment gateway credentials, and third\u2011party integration keys. The weakness is a classic missing authorization failure, classified as CWE-862.", "risk_and_exploitability": "With a CVSS score of 5.3 the issue is of moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Detection hinges on the presence of the public export URL and the ability to enumerate form identifiers. Once accessed, an attacker can exfiltrate potentially sensitive configuration data without authentication."}}}}, "created": "2026-02-02T09:26:44.687926+00:00", "updated": "2026-04-20T21:00:12.967311+00:00", "vendors": ["webaways", "webaways$PRODUCT$nex-forms-ultimate-forms-plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}