CVE-2021-34676: 
WordPress vulnerability analysis and mitigation

CVE-2021-34676 affects Basix NEX-Forms, a WordPress form builder plugin, through version 7.8.7. The vulnerability allows authentication bypass specifically for Excel report generation functionality. The issue was discovered and reported in June 2021, with the fix released in version 7.8.8 (NVD, WPScan).

The vulnerability exists due to missing access control checks in the 'export_csv' plugin handler. When requesting Excel exports, the plugin fails to verify user authentication when the global GET parameter 'export_csv' is set to 'true'. This can be exploited by making a request to 'wp-admin/admin.php?page=nex-forms-dashboard&export_csv=true'. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD, GitHub POC).

The vulnerability allows unauthenticated attackers to access and download Excel reports containing form submissions. This could lead to unauthorized access to sensitive or personally identifiable information that was submitted through the forms (GitHub POC).

The vulnerability is easily exploitable by unauthenticated attackers by simply making a request to the affected endpoint with the 'export_csv' parameter set to 'true'. A proof of concept has been publicly published demonstrating the exploitation (GitHub POC).

The vulnerability was fixed in NEX-Forms version 7.8.8. Users are advised to upgrade to this version or later. The fix implements proper access control checks that verify the presence of valid authentication before allowing access to the Excel report functionality (Vendor Changelog).