CVE-2026-1948 | webaways NEX-Forms Plugin up to 9.1.9 on WordPress deactivate_license authorization

A vulnerability has been found in webaways NEX-Forms Plugin up to 9.1.9 on WordPress and classified as critical. This affects the function deactivate_license. This manipulation causes missing authorization.

This vulnerability is tracked as CVE-2026-1948. The attack is possible to be carried out remotely. No exploit exists.