Vulnerability · Published Mar 12, 2025 · Assigned by Wordfence
CVE-2024-13498NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure
Medium 5.3
In plain English
A medium-severity information exposure in NEX-Forms – Ultimate Forms Plugin for WordPress from webaways. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.8.1 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| webaways | NEX-Forms – Ultimate Forms Plugin for WordPress | 0 – through 8.8.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N