What is the CVSS score of CVE-2026-1782?

CVE-2026-1782 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1782

EUVD-2026-22851 MEDIUM

Improper Input Validation (CWE-20)

2026-04-15 Wordfence

Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 09:09 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 09:00 euvd

EUVD-2026-22851

Analysis Generated

Apr 15, 2026 - 09:00 vuln.today

CVE Published

Apr 15, 2026 - 08:28 nvd

MEDIUM 5.3

DescriptionCVE.org

The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without recomputing or validating it against the configured form price. This makes it possible for unauthenticated attackers to manipulate the payment amount via the 'mf-calculation' field in the form submission REST request granted there exists a specific form with this particular configuration.

AnalysisAI

Remote attackers can manipulate payment amounts in Stripe and PayPal transactions through the MetForm Pro WordPress plugin by submitting arbitrary values in the 'mf-calculation' field, bypassing price validation. Versions up to 3.9.7 are affected; the plugin fails to recompute or validate user-submitted calculation fields against configured form prices, allowing unauthenticated attackers to reduce or alter payment amounts on vulnerable forms. No active exploitation has been publicly confirmed, though the attack requires minimal complexity and produces direct financial impact.

Technical ContextAI

MetForm Pro is a WordPress form builder plugin that integrates with payment gateways (Stripe and PayPal). The vulnerability stems from improper input validation (CWE-20) in the REST API payment form submission handler. When a form includes price calculation or payment integration, the plugin accepts the 'mf-calculation' field value directly from the client-side form submission without server-side recomputation or validation. This allows an attacker to craft a malicious REST request containing an arbitrary 'mf-calculation' value, which the payment integration then processes as the legitimate transaction amount. The root cause is trust of untrusted user input without cryptographic or logical verification against the form's configured pricing rules. CPE identifier cpe:2.3:a:wpmet:metform_pro:*:*:*:*:*:*:*:* indicates the vulnerability affects all versions of the wpmet MetForm Pro product.

RemediationAI

Update MetForm Pro to a patched version released after 3.9.7 via the WordPress plugin dashboard or directly from https://wpmet.com/plugin/metform/. The vendor has released a fix; administrators should check the plugin's changelog for the first patched release following version 3.9.7 and apply it immediately to all affected installations. As a temporary workaround prior to patching, disable payment integration forms or restrict form access via user role/authentication controls, though this is not a complete mitigation. Verify that any payment transactions processed via vulnerable versions are audited for discrepancies. Review transaction logs in Stripe and PayPal dashboards for suspicious amount modifications during the exposure window.