# MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor <= 4.3.3 - Unauthenticated Sensitive Information Exposure via Log File

- **ID:** WPSEC-2026-2306
- **Plugin:** MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor (`metform`), https://wordpress.org/plugins/metform/
- **Affected versions:** from 4.3.3 before 4.3.4
- **Fixed in:** 4.3.4 (Update to 4.3.4 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-532
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/metform
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2306/

## Description

The MetForm plugin for WordPress is vulnerable to Sensitive Information Exposure in version 4.3.3 due to the form submission handler writing the submitted form data and, for submissions that pass the earlier checks, the form settings, which include integration credentials such as API keys and webhook URLs, to the PHP error log. This makes it possible for unauthenticated attackers to extract submitted personal data and integration secrets when the error log is publicly accessible, for example a debug.log file in a web-accessible directory.

## References

- https://wpsec.com/vuln/WPSEC-2026-2306/
- https://plugins.svn.wordpress.org/metform/tags/4.3.4/
- https://wordpress.org/plugins/metform/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2306/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.