Vulnerabilities / MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor / WPSEC-2026-2306
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.3 - Unauthenticated Sensitive Information Exposure via Log File
Low 3.7
CWE-532Fixed in 4.3.4
- ID
- WPSEC-2026-2306
- Plugin
- MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor (metform)
- Affected
- from 4.3.3 before 4.3.4
- Remediation
- Update to 4.3.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-532
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The MetForm plugin for WordPress is vulnerable to Sensitive Information Exposure in version 4.3.3 due to the form submission handler writing the submitted form data and, for submissions that pass the earlier checks, the form settings, which include integration credentials such as API keys and webhook URLs, to the PHP error log. This makes it possible for unauthenticated attackers to extract submitted personal data and integration secrets when the error log is publicly accessible, for example a debug.log file in a web-accessible directory.
References
- https://wpsec.com/vuln/WPSEC-2026-2306/
- https://plugins.svn.wordpress.org/metform/tags/4.3.4/
- https://wordpress.org/plugins/metform/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS