Metform CVE-2026-114180

Exploitation requires only that the target WordPress site runs the Metform plugin at any version from its initial release through 4.3.2 - no authentication, no user interaction, and no non-default configuration are indicated by the CVSS vector (PR:N/UI:N/AC:L). The practical limiting factor is scope of impact: the flaw is integrity-only (C:N/I:L/A:N), so an attacker can invoke or alter a restricted action but cannot read confidential data or disrupt availability through this issue alone. The input does not name the exact protected feature or endpoint missing the authorization check, so defenders cannot scope it to a specific setting beyond 'the affected Metform action must be reachable'. Mitigation is to update past 4.3.2 once a fixed release is confirmed.

This is a moderate-severity (CVSS 5.3) Missing Authorization flaw (CWE-862) in the Metform WordPress plugin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, but with impact limited to integrity only (I:L) and no confidentiality or availability impact. The low integrity-only impact is why the score caps at 5.3 despite being remotely and trivially reachable. On real-world signals this is NOT a top-tier priority: there is no CISA KEV listing, no public exploit code referenced, and no EPSS probability provided in the input - so exploitation prTessure cannot be quantified and is unconfirmed. The 'Authentication Bypass' tag supplied with the report should be read as broken/missing access control (consistent with CWE-862 and PR:N) rather than a full credential bypass; the integrity-only impact suggests an attacker can invoke a protected action or modify limited data, not read sensitive data or take over the site. Treat as a routine 'patch in normal cycle' item unless the specific affected endpoint proves to expose sensitive operations.

A remote, unauthenticated attacker sends a crafted HTTP request directly to a Metform plugin endpoint (e.g., an AJAX/REST action) that fails to verify the caller's authorization, allowing an action that should be restricted. Because the request needs no authentication or user interaction, it can be scripted against any site running Metform through version 4.3.2. No public proof-of-concept is referenced, so exploitation would require the attacker to identify the unprotected endpoint themselves.