MetForm Pro CVE-2026-24610

Exploitation requires the attacker to hold an active subscriber-level (or higher) WordPress account on the target installation - this is the minimum authenticated role in WordPress (PR:L as reflected in the CVSS vector). Open user registration on the WordPress site enables unauthenticated actors to self-create subscriber accounts, significantly lowering the barrier to exploitation. Sites where registration is closed or invite-only are materially harder to exploit, as the attacker must obtain credentials through other means (phishing, credential stuffing, prior breach). The vulnerability is not exploitable by unauthenticated visitors. No specific plugin feature toggle, non-default configuration, or server-side platform dependency has been identified as an additional prerequisite in the available data.

The provided CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects the constrained impact profile: network exploitability at low complexity is partially offset by the mandatory subscriber-level account requirement (PR:L) and the limited integrity-only impact with no confidentiality or availability consequence. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified; however, the absence of a CISA KEV listing and no confirmed public exploit code suggests this is not under active mass exploitation. Real-world risk is further bounded by the requirement that an attacker already possess a valid WordPress account on the target site - open registration must be enabled or credentials obtained separately. Sites restricting user registration or operating in closed environments face materially lower exposure than public-facing WordPress installations with open subscriber sign-up.

An attacker registers a free subscriber account on a WordPress site running MetForm Pro <= 3.9.1 (or uses compromised credentials). The attacker then sends a crafted authenticated request - such as an AJAX call or REST API request - to a MetForm Pro endpoint that lacks proper capability checks, successfully invoking an action reserved for higher-privileged roles and modifying plugin-managed data or form configurations. No public proof-of-concept code has been identified at time of analysis, so the specific endpoint and payload are not externally confirmed.