CVE-2024-1130: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-1130) affects the NEX-Forms – Ultimate Form Builder WordPress plugin, discovered in versions up to and including 8.5.6. The vulnerability was publicly disclosed on February 28, 2024, and involves unauthorized access due to a missing capability check in the set_read() function (NVD).

The vulnerability stems from a missing authorization check in the set_read() function, which allows authenticated users with subscriber-level access or higher to manipulate record states. The severity is rated as MEDIUM with a CVSS v3.1 base score of 4.3 (NIST) and 5.3 (Wordfence), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-862: Missing Authorization (NVD).

The vulnerability allows authenticated attackers with subscriber-level access or higher to mark records as read without proper authorization, potentially affecting the integrity of form submission tracking and management (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. The attack complexity is rated as Low (AC:L), requiring network access (AV:N) but no user interaction (UI:N) (NVD).

Users should upgrade to version 8.5.7 or later of the NEX-Forms plugin, which includes patches that address the missing capability check vulnerability (NVD).