CVE-2023-52120 is a medium severity (5.4 CVSS) cross-site request forgery flaw in the NEX-Forms plugin for WordPress, in versions through 8.5.2. Patchstack lists 8.5.5 as the patched release, so update to 8.5.5 or later. Exploitation needs a signed-in privileged user to be tricked into sending a request.
What's affected
The NVD record covers NEX-Forms from Basix, a form builder plugin, in all versions through 8.5.2. Patchstack agrees on the vulnerable range and names 8.5.5 as the patched version.
The record classifies the weakness as CWE-352 (Cross-Site Request Forgery). The CVSS vector in the record is network based with no privileges required but with user interaction required, and it scores low confidentiality, high integrity, low availability impact. The advisory does not say which plugin action lacks the check, so assume any admin screen of the plugin could be involved until you have updated.
How to check if you're exposed
On a site you manage, list installed plugins and their versions with wp-cli:
wp plugin list --fields=name,version,update_version,status
wp plugin get nex-forms-express-wp-form-builder --field=version
The slug nex-forms-express-wp-form-builder comes from the Patchstack advisory address. Confirm it matches the folder name under wp-content/plugins on your site. If the version is 8.5.2 or lower, the site is in the affected range. You can also read the version on the Plugins screen of the WordPress dashboard.
For agencies, run the same listing across every client site and collect the results in one sheet. Plugins that are installed but inactive still count as inventory.
What to do now
- Take a backup or snapshot before changing anything.
- Update NEX-Forms to 8.5.5 or later, from the dashboard or with
wp plugin update nex-forms-express-wp-form-builder. - If the plugin is unused, deactivate and delete it instead of updating it.
- Review recent changes in the plugin settings and look for administrator accounts you do not recognise.
- Ask administrators to use a separate browser profile for admin work and to sign out when finished, which shrinks the window a forged request needs.
Why it matters
With cross-site request forgery, the attacker never needs the victim's password. The attacker only needs the victim's browser to send a request while a session is open. A plugin that accepts such requests without verifying a per-user token trusts the browser too much.
The record scores this at 5.4, and Patchstack rates it low priority. The gap is normal for CSRF: the attack needs the victim to be signed in and to open a hostile page, which lowers the odds even when the impact on a site is real. It is still a one-click update, so there is little reason to wait. The KEV flag in the record is false, and none of the sources we read claim exploitation in the wild.
Quick check
Is a firewall rule enough instead of updating?
A web application firewall can block some forged requests, but the fix is the patched plugin release. Use a rule as a stopgap if you cannot update today, then update.
What if I no longer use the plugin?
Deactivate and delete it. Inactive plugins still sit on disk, and their files can remain reachable on some setups, so removal is safer than leaving them deactivated.
Sources
Last reviewed: 19 October 2026.
