{
 "id": "WPSEC-2026-2306",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2306/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2306/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2306/index.md",
 "title": "MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.3 - Unauthenticated Sensitive Information Exposure via Log File",
 "description": "The MetForm plugin for WordPress is vulnerable to Sensitive Information Exposure in version 4.3.3 due to the form submission handler writing the submitted form data and, for submissions that pass the earlier checks, the form settings, which include integration credentials such as API keys and webhook URLs, to the PHP error log. This makes it possible for unauthenticated attackers to extract submitted personal data and integration secrets when the error log is publicly accessible, for example a debug.log file in a web-accessible directory.",
 "plugin": {
  "slug": "metform",
  "name": "MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor",
  "full_name": "MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/metform/",
  "advisories_url": "https://wpsec.com/vuln/plugin/metform/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/metform"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-532"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.3.3",
    "from_inclusive": true,
    "to": "4.3.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.3.3 before 4.3.4"
  ]
 },
 "introduced_in": "4.3.3",
 "fixed_in": "4.3.4",
 "remediation": "Update to 4.3.4 or later.",
 "fix_released": "2026-11-02T08:11:30+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:38:43.117012+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2306/",
  "https://plugins.svn.wordpress.org/metform/tags/4.3.4/",
  "https://wordpress.org/plugins/metform/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/metform",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}