MetForm CVE-2026-18100

Exploitation requires a valid WordPress user account with at minimum contributor-level role. The attacker must be able to create or edit Elementor-built pages with the MetForm widget placed and the 'mf_form_id' setting editable. Two specific application behaviors must be present and are confirmed in the referenced source: Elementor's wp_kses_post save-time filter must be active (the default in all Elementor-based installations), and MetForm's str_replace script-tag transformation must be reachable (util.php line 605). No non-default server configuration or additional plugin is required beyond having MetForm installed with a form widget on at least one published page. Exploitation is strictly bounded by the contributor access requirement - sites that disable open user registration and restrict contributor roles to vetted internal staff face substantially lower realistic exposure. Victim users do not need to take any action beyond passively loading the injected page.

The CVSS 6.4 Medium score reflects a meaningful real-world constraint: contributor-level access (PR:L) is a genuine gatekeeping requirement that limits exposure on sites with tightly controlled user roles. The scope change metric (S:C) correctly captures that exploitation crosses from the server-side WordPress application into victim browsers. EPSS data was not included in the provided intelligence, so exploitation probability cannot be independently quantified. The vulnerability is not listed in CISA KEV and no public exploit has been identified. Despite the moderate numeric score, the dual bypass mechanism - independently circumventing both Elementor's wp_kses_post and MetForm's own str_replace transformation - indicates above-average technical sophistication; a threat actor who obtained contributor credentials via phishing or credential stuffing could reliably exploit this without further obstacle. Organizations running open contributor registration models should treat remediation as more urgent than the raw score implies, while sites with strictly vetted contributors face lower practical risk. No data conflicts or inconsistencies were identified between the CVSS vector and the described exploitation conditions.

An attacker who has obtained or self-registered a contributor-level WordPress account opens the Elementor editor on any page, places a MetForm form widget, and enters a crafted tag-free payload into the 'mf_form_id' widget setting. The payload bypasses wp_kses_post on save and is stored in the database; MetForm's str_replace transformation converts it into an executable JavaScript template literal on output. Any subsequent visitor - including site administrators - who loads that page has the script execute silently in their browser, enabling the attacker to exfiltrate session cookies or redirect victims to phishing pages.